NPF is a BSD licensed stateful packet filter, a central piece of software for firewalling

Firewall (computing)

A firewall is a device or set of devices designed to permit or deny network transmissions based upon a set of rules and is frequently used to protect networks from unauthorized access while permitting legitimate communications to pass....

. It is comparable to iptables

Iptables

iptables is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall and the chains and rules it stores...

, ipfw

Ipfirewall

ipfirewall or ipfw is a FreeBSD IP packet filter and traffic accounting facility. Its ruleset logic is similar to many other packet filters except IPFilter. ipfw is authored and maintained by FreeBSD volunteer staff members. Its syntax enables use of sophisticated filtering capabilities and thus...

, ipfilter

IPFilter

IPFilter is an open source software package that provides firewall services and network address translation for many UNIX-like operating systems. The author and software maintainer is Darren Reed. IPFilter supports both IPv4 and IPv6 protocols, and is a stateful firewall.IPFilter is delivered...

 and PF

PF (firewall)

PF is a BSD licensed stateful packet filter, a central piece of software for firewalling. It is comparable to iptables, ipfw and ipfilter...

. NPF is developed on NetBSD

NetBSD

NetBSD is a freely available open source version of the Berkeley Software Distribution Unix operating system. It was the second open source BSD descendant to be formally released, after 386BSD, and continues to be actively developed. The NetBSD project is primarily focused on high quality design,...

.

History

NPF was primarily written by Mindaugas Rasiukevicius. Work on NPF was sponsored by the NetBSD Foundation. The initial code was committed in NetBSD CVS repositories on August 22, 2010. NPF first appeared in NetBSD 6.0.

Features

• NPF is designed for high performance on multi-core and multi-processor machines, and for easy extensibility. The packet filter will no longer be the bottleneck in a multicore router.
• The packet-inspection engine is inspired by BPFs (N-Code processor)
• The syntax for configuration and utilities (npfctl) is familiar for users of PF

External links

• Original announcement on NetBSD lists
• Manpage for npf.conf on NetBSD-current