[feld]

OpenBSD's pf doesn't handle layer2.

(imo) Nothing beats FreeBSD's IPFW when it comes to features, but OpenBSD is still king of syntax/usability.

[gonzo]

Upvote.

ipfw has better performance, too.

I guess what we need is some lex/yacc work to make a pf.conf syntax work with ipfw.

Largest issue is pf is "lastmatch wins" (copied from ipfilter, and a mistake that even Henning admits) and ipfw is “first match wins”.

pfSense makes all of rules "quick" to workaround this issue.

So without a ton of work, we could get the syntax (via an external package), but the semantics of existing pf.conf would be more difficult.

The rest is we would need the equivalent of pfsync.

[SpiegS]

Never needed to do something with layer2. I used it mostly for educational purposes for my home network. Can you name some real world examples when OSI layer2 filtering is needed?

[ryan-c]

I use layer 2 filtering on my home network in order to get direct internet access without going through my "mandatory" ISP-provided gateway that authenticates the port with 802.1x EAP-TLS.

[BrandoElFollito]

Containers connected to a common bridge, for which you want to restrict traffic (between them). You have to do that at L2.

[nisa]

mesh networks that use a layer 2 routing protocoll - or if you have VPNs that use layer2 and you want to filter the clients on the VPN server bridge.