From owner-freebsd-pf@freebsd.org  Tue Jun 26 06:32:14 2018
Return-Path: <owner-freebsd-pf@freebsd.org>
Delivered-To: freebsd-pf@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2EDEE10139B7
 for <freebsd-pf@mailman.ysv.freebsd.org>; Tue, 26 Jun 2018 06:32:14 +0000 (UTC)
 (envelope-from srs0=9bd2=jm=sigsegv.be=kristof@codepro.be)
Received: from venus.codepro.be (venus.codepro.be [IPv6:2a01:4f8:162:1127::2])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
 bits))
 (Client CN "*.codepro.be", Issuer "Gandi Standard SSL CA 2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id B582582202
 for <freebsd-pf@freebsd.org>; Tue, 26 Jun 2018 06:32:13 +0000 (UTC)
 (envelope-from srs0=9bd2=jm=sigsegv.be=kristof@codepro.be)
Received: from [172.28.128.1]
 (ptr-8rgnodx8wv4znqkk2bx.18120a2.ip6.access.telenet.be
 [IPv6:2a02:1811:240b:b802:fd34:9b7d:45b0:b4cd])
 (Authenticated sender: kp)
 by venus.codepro.be (Postfix) with ESMTPSA id CC7E84491C;
 Tue, 26 Jun 2018 08:32:11 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sigsegv.be; s=mail;
 t=1529994731; bh=mIduzaGbXgMB6u/RnKoUld5rt68losW+ENjyGpX+Gtg=;
 h=From:To:Cc:Subject:Date:In-Reply-To:References;
 b=XczO6zAVCwV2lMsaoxQui8479aDuaHJt3M1LFlSxZKh2mHJd1qU5rr63BksM7ZkpV
 SFcpzgES44unQ2UXl/pXBctwu3B751lzq6nAL71oiC/SwUgX9OrZdWTvucoRIz/sI+
 TW5MQWm8nuLfomgN7AWxW68eJLBzEsW+4C8jc73U=
From: "Kristof Provost" <kristof@sigsegv.be>
To: "Joseph Ward" <jbwlists@hilltopgroup.com>
Cc: freebsd-pf@freebsd.org
Subject: Re: "egress" group
Date: Tue, 26 Jun 2018 08:32:09 +0200
X-Mailer: MailMate (2.0BETAr6113)
Message-ID: <19CD2668-9ADC-47A5-865F-7CA93732D11C@sigsegv.be>
In-Reply-To: <1822764a-e237-ddd3-639d-62fd01b2bbdc@hilltopgroup.com>
References: <1822764a-e237-ddd3-639d-62fd01b2bbdc@hilltopgroup.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Content-Filtered-By: Mailman/MimeDel 2.1.26
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 26 Jun 2018 06:32:14 -0000

On 25 Jun 2018, at 22:12, Joseph Ward wrote:
> My current pf.conf contains the following lines (with a lot of other
> stuff redacted for irrelevance):
>
> ext_if="em0"
> ...
> block log all
> pass in on $ext_if proto tcp from any to any port 22 flags S/SA keep 
> state
>
>
> and it works great; ssh is able to get in.  However, when I change
> "$ext_if" to "egress", it no longer works.  From the various
> documentation I've found online, egress should automatically be the
> interface which has the default route, and netstat -rn gives me:
>
‘egress’ exists in OpenBSD’s pf, but not in FreeBSD.

> My goal is for this pf.conf to be able to be used on multiple systems
> which unfortunately have different network cards, so the interface 
> names
> are different.  If "egress" isn't going to work, is there another way 
> to
> accomplish that goal?
>
You could rename your network card (ifconfig em0 name foo). That’d let 
  you hide the difference from pf (but you’d have to cope with it in 
/etc/rc.conf)

Regards,
Kristof