script to dump PF status

pfdump.sh

#!/bin/bash

# print an anchor subset (r, n or A)

function pfprint() {

# avoid trusting PATH and .
  /usr/bin/sudo pfctl -a "$2" -s"$1" 2>/dev/null
}

# print a full anchor content

function pfprint_all() {

# print the anchor name on 1st line, and all content indented
  local anchor=$(printf "%-40s" ${1:-"/"})
  local indent=$(printf "%-40s")
  (
    pfprint r "$1" | sed "s,^,r     ,"
    pfprint n "$1" | sed "s,^,n     ,"
    pfprint A "$1" | sed "s,^,A ,"
  ) | sed -e "1s,^,${anchor}," -e "2,\$s,^,${indent},"

# recursively descend the anchors tree
  for a in $(pfprint A "$1") ; do
    pfprint_all "$a"
  done
}

pfprint_all

Suppress repeated anchor name printing, and indented content of anchor
to make the structure of anchors tree visible.

Super useful. Thank you!