---
name: "pfilctl"
section: "8"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/pfilctl"
---

# pfilctl(8)

pfil(9) control utility

## NAME

**pfilctl** – [pfil(9)](/pfil/9.md) control utility

## SYNOPSIS

**pfilctl** **heads**

**pfilctl** **hooks**

**pfilctl** **link** ⟨**-i** \| **-o**⟩ \[**-a**\] *hook* *head*

**pfilctl** **unlink** ⟨**-i** \| **-o**⟩ *hook* *head*

## DESCRIPTION

The **pfilctl** utility is intended to view and change configuration of the [pfil(9)](/pfil/9.md) packet filtering hooks and filters on them.

## COMMANDS

- **heads**

  List available packet filtering points.

- **hooks**

  List available packet filters.

-

  **link** ⟨**-i** \| **-o**⟩ \[**-a**\] *hook* *head* Link *hook* to *head*. With the **-i** flag the hook will be connected as input and with **-o** as output hook. At least one of **-i** or **-o** is required. By default **pfilctl** will prepend the hook in front of other hooks if any present: new hook will be as close to the wire as possible, so that on input it will be the first filter and on output it will be the last. Adding the **-a** flag switches to appending new hook instead of prepending.

-

  **unlink** ⟨**-i** \| **-o**⟩ *hook* *head* Unlink *hook* on *head*. At least one of **-i** or **-o** is required. With the **-i** flag the hook will be removed from the input list of hooks and with **-o** on output list.

## SEE ALSO

[ipfilter(4)](/ipfilter/4.md), [ipfw(4)](/ipfw/4.md), [pf(4)](/pf/4.md), [pfil(9)](/pfil/9.md)

## AUTHORS

The **pfilctl** utility was written by Gleb Smirnoff ⟨*glebius@FreeBSD.org*⟩.