For packet rule testing, legacy 5 tuple based techniques employ decision tree, decomposition or hardware (usually TCAM) based approaches. What specific technique do pfSense firewalls employ to test the packets against the rules with minimal hardware requirements. As the rules are defined usually by 5 tuple for IPv4, a firewall has to match each incoming packet and transport header fields against the stored rule set. How does a firewall decide which rule an incoming packet is matched to either pass or to block and also maintain line-rate?
pfSense is a open-source software firewall, so the most obvious answer for how they do it is "take a look at the source code". Programming techniques are off-topic here anyway.
Being a software firewall, pfSense doesn't require special hardware like ASICs or TCAM. It can use offloading functions provided by the NIC but that's about it. So it's all about code efficiency.
A hardware-based firewall can make heavy use of TCAM, enabling very efficient table lookups. ASICs can further speed up more complex processing.
Given the speed of a good CPU, a software-based approach can provide excellent throughput and overall performance, but a hardware-based firewall can probably still have superior latency.
If packet souce ip address , destination ip address , service ports, application id matches against the policy framed in firewall and further check for route entry . if its matches with firewall configuration packet is allowed by firewall toward outside to inside network and inside to outside networks .
If above parameters are not matching then firewall will simply drops the packet with the reference to clean up rule .