Though I may have wanted to, it proved impossible to cover all possible wrinkles of PF configuration. I hope that the resources listed here will fill in some details or present a slightly different perspective. Some of them are even quite enjoyable reads for their own sake.
The following are the general web-accessible resources cited throughout the book. It is worth looking at the various BSD projects’ websites for the most up-to-date information.
Of particular interest for OpenBSD users is the online OpenBSD Journal (http://undeadly.org/). It offers news and articles about OpenBSD and related issues.
OpenBSD’s website, http://www.openbsd.org/, is the main reference for OpenBSD information. If you’re using OpenBSD, you will be visiting this site every now and then.
You will find a collection of presentations and papers by OpenBSD developers at http://www.openbsd.org/papers/. This site is a good source of information about ongoing developments in OpenBSD.
OpenBSD’s Documentation and Frequently Asked Questions, (http://www.openbsd.org/faq/index.html) is more of a user guide than a traditional question-and-answer document. This is where you’ll find a generous helping of background information and step-by-step instructions on how to set up and run your OpenBSD system.
Henning Brauer’s presentation “Faster Packets—Performance Tuning in the Network Stack and PF” (http://bulabula.org/papers/2009/eurobsdcon-faster_packets/) is the current main PF developer’s overview of the work done in recent OpenBSD releases to improve network performance, with PF as a main component.
PF: The OpenBSD Packet Filter (http://www.openbsd.org/faq/pf/index.html), also known as the PF User Guide or the PF FAQ, is the official PF documentation, maintained by the OpenBSD team. This guide is updated for each release, and it’s an extremely valuable reference resource for PF practitioners.
Bob Beck’s “pf. It’s not just for firewalls anymore” (http://www.ualberta.ca/~beck/nycbug06/pf/) is a NYCBUG 2006 presentation that covers PF’s redundancy and reliability features, with real-world examples taken from the University of Alberta network.
Daniel Hartmeier’s PF pages (http://www.benzedrine.cx/pf.html) are his collection of PF-related material with links to resources around the Web.
Daniel Hartmeier’s “Design and Performance of the OpenBSD Stateful Packet Filter (pf )” (http://www.benzedrine.cx/pf-paper.html) is the paper he presented at Usenix 2002, which describes the initial design and implementation of PF.
Daniel Hartmeier’s three-part undeadly.org PF series includes “PF: Firewall Ruleset Optimization” (http://undeadly.org/cgi?action=article&sid=20060927091645), “PF: Testing Your Firewall (http://undeadly.org/cgi?action=article&sid=20060928081238), and “PF: Firewall Management” (http://undeadly.org/cgi?action=article&sid=20060929080943). The three articles cover their respective subjects in great detail, yet manage to be quite readable.
RFC 1631, The IP Network Address Translator (NAT), May 1994 (http://www.ietf.org/rfc/rfc1631.txt?number=1631) is the first part of the NAT specification, which has proved longer lived than the authors had apparently intended. While still an important resource for understanding NAT, it has been largely superseded by the updated RFC 3022, dated January 2001.
RFC 1918, Address Allocation for Private Internets, February 1996 (http://www.ietf.org/rfc/rfc1918.txt?number=1918) is the second part of the NAT and private address space puzzle. This RFC describes the motivations for the allocation of private, nonroutable address space and defines the address ranges. RFC 1918 has been designated a Best Current Practice.
If you are looking for a text that gives you a thorough and detailed treatment of network protocols with a clear slant toward the TCP/IP worldview, Charles M. Kozierok’s The TCP/IP Guide (No Starch Press, October 2005), available online with updates at http://www.tcpipguide.com/, has few, if any, serious rivals. At more than 1,600 pages, it’s not exactly a pocket guide, but it’s very useful to have on your desk or in a browser window to set the record straight on any networking terms that you find insufficiently explained in other texts.