/hub/runs/protectli-isolated-pf-packet-checks
Published resultTest date: 2026-10-05Measured on: Protectli V1610

Protectli V1610: Isolated PF Packet Checks

I used three temporary FreeBSD VNET stacks on the Vault to check a small PF policy with real packets, captures and counters. The eight cases cover allowed controls, NAT, unsolicited WAN traffic, spoofing and finite bursts.

This page keeps the shared controls, retained measurements, failures, and comparison limits together. The linked files are there when you need the underlying table or method.

What you can compare here

The authored policy mirrors core LAN pass, WAN deny, NAT and anti-spoof behavior. It does not import every OPNsense anchor or table, and the finite bursts are blocking checks rather than a DoS-capacity measurement.

Related pages

Read the article Project repository

You can reuse Trevor-measured data from this page under the repository MIT terms. Retain the required notices when reusing the project documentation, and credit Trevor Unland when citing this run. Project media has separate terms in the repository.

Recorded results

Open the details under any row for the specific setup, outcome, artifact identity, and supporting file.

HTTP and NAT control

Isolated VNET · core PF mirror

Published result

Measured on Protectli V1610 · Virtual packet exchange on the Vault

Response body
39 bytes
Exact body/hash, with observed NAT peer.

HTTP 200 returned the exact 39-byte body/hash; allowed LAN traffic and the NAT peer were verified.

Setup and original evidence

Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror

Pinned results and methodActual test host

HTTPS control

Isolated VNET · core PF mirror

Published result

Measured on Protectli V1610 · Virtual packet exchange on the Vault

Response body
39 bytes
Encrypted transport control; no TLS decryption.

The same endpoint and body/hash passed over HTTPS, with no plaintext UID string in captured TCP payloads.

Setup and original evidence

Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror

Pinned results and methodActual test host

LAN ICMP control

Isolated VNET · core PF mirror

Published result

Measured on Protectli V1610 · Virtual packet exchange on the Vault

Echo replies
3 of 3
Three sent requests. (replies)
Allow-counter packets
6 packets
Requests plus replies.

Three requests received three replies, with six packets on the allow counter.

Setup and original evidence

Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror

Pinned results and methodActual test host

Unsolicited WAN TCP ports

Isolated VNET · core PF mirror

Published result

Measured on Protectli V1610 · Virtual packet exchange on the Vault

Denied SYN packets
8 of 8
Eight distinct destination-port probes. (packets)
Forwarded packets
0 packets
Observed virtual LAN capture.

Eight distinct SYN packets arrived, caused eight deny increments and were not forwarded to the virtual LAN.

Setup and original evidence

Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror

Pinned results and methodActual test host

WAN source-spoof check

Isolated VNET · core PF mirror

Published result

Measured on Protectli V1610 · Virtual packet exchange on the Vault

Anti-spoof counter
5 of 5
Five authored UDP datagrams. (packets)

Five UDP datagrams with a LAN-range source alias arrived on virtual WAN and caused five anti-spoof increments.

Setup and original evidence

Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror

Pinned results and methodActual test host

Finite WAN UDP burst

Isolated VNET · core PF mirror

Published result

Measured on Protectli V1610 · Virtual packet exchange on the Vault

Denied datagrams
200 of 200
Finite burst at configured 100 packets/second. (packets)
Forwarded packets
0 packets
Observed virtual LAN capture.

All 200 packets at a configured 100 packets per second reached the deny counter, with none forwarded.

Setup and original evidence

Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror

Pinned results and methodActual test host

Finite WAN SYN burst

Isolated VNET · core PF mirror

Published result

Measured on Protectli V1610 · Virtual packet exchange on the Vault

Denied SYN packets
100 of 100
Finite connection-attempt fixture. (packets)
Forwarded packets
0 packets
Observed virtual LAN capture.

One hundred finite attempts produced 100 captured SYNs and 100 deny increments, with none forwarded.

Setup and original evidence

Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror

Pinned results and methodActual test host

WAN ICMP deny

Isolated VNET · core PF mirror

Published result

Measured on Protectli V1610 · Virtual packet exchange on the Vault

Denied requests
3 of 3
Three captured echo requests. (packets)
Forwarded packets
0 packets
Observed virtual LAN capture.

Three echo requests arrived on virtual WAN, caused three deny increments and were not forwarded.

Setup and original evidence

Protectli V1610 · FreeBSD VNET / authored PF mirror · Virtual packet exchange on the Vault · Isolated VNET · core PF mirror

Pinned results and methodActual test host

Supporting evidence

Results and method

These are the few files that support this page directly. The repository holds the wider project history.

Packet-exchange matrix Inputs, counts, isolation, failures and cleanup checks.

Controls

  • Three ephemeral VNET stacks and point-to-point virtual links; no physical interface joined the lab.
  • Independent packet captures, per-case rule-counter deltas, body hashes and the observed NAT peer supplied the checks.
  • Host PF rules and configuration hashes matched before and after; the live IDS process stayed the same.
  • All owned jails and interfaces were removed afterward. A first fixture-server launch failed before traffic and was preserved.

What this run established

  • $All eight cases met their packet/counter expectations.
  • $Both allowed controls returned the same 39-byte body, and the HTTPS capture did not expose the plaintext UID string.
  • $The unsolicited WAN, spoof and burst cases incremented their intended deny counters without forwarding those packets to the virtual LAN.
  • $The lab peaked at a sampled 55 °C, below the unchanged 75 °C guard.

The Lab Notes

Get an email when I publish new hardware reviews, benchmarks, and security research. Unsubscribe anytime.

Email goes to Buttondown. Privacy details.

© 2026 Trevor Unland. All rights reserved.

PrivacyTermsRSS Feed

$ echo "Built with React + TypeScript"