From owner-freebsd-i386@FreeBSD.ORG Thu Mar 27 17:30:01 2008 Return-Path: Delivered-To: freebsd-i386@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 87DA81065673 for ; Thu, 27 Mar 2008 17:30:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 6AFC98FC14 for ; Thu, 27 Mar 2008 17:30:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m2RHU1jE002167 for ; Thu, 27 Mar 2008 17:30:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m2RHU1WK002166; Thu, 27 Mar 2008 17:30:01 GMT (envelope-from gnats) Resent-Date: Thu, 27 Mar 2008 17:30:01 GMT Resent-Message-Id: <200803271730.m2RHU1WK002166@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-i386@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Roman Sindarovskiy Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8C8DC1065670 for ; Thu, 27 Mar 2008 17:25:17 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 818898FC24 for ; Thu, 27 Mar 2008 17:25:17 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.2/8.14.2) with ESMTP id m2RHP0SU091637 for ; Thu, 27 Mar 2008 17:25:00 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.2/8.14.1/Submit) id m2RHP0T6091636; Thu, 27 Mar 2008 17:25:00 GMT (envelope-from nobody) Message-Id: <200803271725.m2RHP0T6091636@www.freebsd.org> Date: Thu, 27 Mar 2008 17:25:00 GMT From: Roman Sindarovskiy To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: i386/122164: /etc/rc.d/pf reload don't work X-BeenThere: freebsd-i386@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: I386-specific issues for FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Mar 2008 17:30:01 -0000 >Number: 122164 >Category: i386 >Synopsis: /etc/rc.d/pf reload don't work >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-i386 >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Mar 27 17:30:01 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Roman Sindarovskiy >Release: 6.2 >Organization: n/a >Environment: FreeBSD main.sltk.ru 6.2-RELEASE-p4 FreeBSD 6.2-RELEASE-p4 #0: Thu Apr 26 17:55:55 UTC 2007 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/SMP i386 >Description: I use pf with rules listed below ext_if = "em0" int_if = "em1" host_admin = "89.179.a1.b1" host_main = "83.102.a2.b2" host_alfa = "83.102.a2.b3" host_test1 = "192.168.10.101" # jail1 host_test2 = "192.168.10.107" # jail2 tcp_port_main = "{ 40008 }" tcp_port_alfa = "{ smtp, www, pop3, imap }" tcp_port_beta = "{ www }" tcp_port_delta = "{ ftp }" nat pass on $ext_if from $host_test1 to any -> $host_main block log all pass in on lo0 pass in on em1 pass in on $ext_if inet proto { tcp, udp, icmp } from $host_admin keep state pass in on $ext_if inet proto tcp to $host_main port $tcp_port_main keep state pass in on $ext_if inet proto udp to $host_main port domain pass in on $ext_if inet proto tcp to $host_alfa port $tcp_port_alfa keep state pass out all keep state All working without any errors. When I added additional line nat pass on $ext_if from $host_test2 to any -> $host_main and then reload pf rules /etc/rc.d/pf reload nat in my jails are stop working >How-To-Repeat: add rule, reload pf >Fix: stop pf /sbin/pfctl -d /sbin/kldunload pflog /sbin/kldunload pf start pf /sbin/kldload pf /sbin/pfctl -e /sbin/pfctl -f /etc/pf.conf >Release-Note: >Audit-Trail: >Unformatted: