Date: Thu, 27 Mar 2008 17:25:00 GMT From: Roman Sindarovskiy <rakis@yandex.ru> To: freebsd-gnats-submit@FreeBSD.org Subject: i386/122164: /etc/rc.d/pf reload don't work Message-ID: <200803271725.m2RHP0T6091636@www.freebsd.org> Resent-Message-ID: <200803271730.m2RHU1WK002166@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 122164
>Category: i386
>Synopsis: /etc/rc.d/pf reload don't work
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-i386
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Thu Mar 27 17:30:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator: Roman Sindarovskiy
>Release: 6.2
>Organization:
n/a
>Environment:
FreeBSD main.sltk.ru 6.2-RELEASE-p4 FreeBSD 6.2-RELEASE-p4 #0: Thu Apr 26 17:55:55 UTC 2007 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/SMP i386
>Description:
I use pf with rules listed below
ext_if = "em0"
int_if = "em1"
host_admin = "89.179.a1.b1"
host_main = "83.102.a2.b2"
host_alfa = "83.102.a2.b3"
host_test1 = "192.168.10.101" # jail1
host_test2 = "192.168.10.107" # jail2
tcp_port_main = "{ 40008 }"
tcp_port_alfa = "{ smtp, www, pop3, imap }"
tcp_port_beta = "{ www }"
tcp_port_delta = "{ ftp }"
nat pass on $ext_if from $host_test1 to any -> $host_main
block log all
pass in on lo0
pass in on em1
pass in on $ext_if inet proto { tcp, udp, icmp } from $host_admin keep state
pass in on $ext_if inet proto tcp to $host_main port $tcp_port_main keep state
pass in on $ext_if inet proto udp to $host_main port domain
pass in on $ext_if inet proto tcp to $host_alfa port $tcp_port_alfa keep state
pass out all keep state
All working without any errors.
When I added additional line
nat pass on $ext_if from $host_test2 to any -> $host_main
and then reload pf rules
/etc/rc.d/pf reload
nat in my jails are stop working
>How-To-Repeat:
add rule, reload pf
>Fix:
stop pf
/sbin/pfctl -d
/sbin/kldunload pflog
/sbin/kldunload pf
start pf
/sbin/kldload pf
/sbin/pfctl -e
/sbin/pfctl -f /etc/pf.conf
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200803271725.m2RHP0T6091636>