Date: Tue, 12 Jan 2021 20:31:54 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 252617] pfctl -a '*' -sn does not recursively print nat-anchors Message-ID: <bug-252617-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D252617 Bug ID: 252617 Summary: pfctl -a '*' -sn does not recursively print nat-anchors Product: Base System Version: 12.2-RELEASE Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: bin Assignee: bugs@FreeBSD.org Reporter: guido@kollerie.com According to "man pfctl" one should use "-a '*'" to recursively print the main ruleset. That does work for filter anchors (eg 'anchor') but not for NAT anchors (eg 'nat-anchor'). Given the loaded ruleset: ext_if=3D"lagg0" set skip on lo0 scrub in nat-anchor vm=20 block in pass out pass in on $ext_if proto tcp from any to ($ext_if) port { ssh, domain, http, https } pass in on $ext_if proto udp to ($ext_if) port domain pass in on $ext_if inet proto icmp to ($ext_if) icmp-type { unreach, re= dir, timex, echoreq } anchor vm=20 Running: pfctl -a vm -f - <<EOT nat on lagg0 from vm-public:network to any -> (lagg0) pass in on vm-public EOT should load the new NAT and filter rules into the appropriate anchor positions. When we run: pfctl -a '*' -sr The filter ruleset is properly recursively printed: scrub in all fragment reassemble block drop in all pass in on lagg0 proto tcp from any to (lagg0) port =3D ssh flags S/SA = keep state pass in on lagg0 proto tcp from any to (lagg0) port =3D domain flags S/= SA keep state pass in on lagg0 proto tcp from any to (lagg0) port =3D http flags S/SA= keep state pass in on lagg0 proto tcp from any to (lagg0) port =3D https flags S/S= A keep state pass in on lagg0 proto udp from any to (lagg0) port =3D domain keep sta= te pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type unreach = keep state pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type redir ke= ep state pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type timex ke= ep state pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type echoreq = keep state pass out all flags S/SA keep state anchor "vm" all { pass in on vm-public all flags S/SA keep state } But the NAT ruleset however is not: pfctl -a '*' -sn prints: nat-anchor "vm" all Only when we explicitly name the anchor, will the NAT ruleset be printed: pfctl -a vm -sn prints: nat on lagg0 inet from 10.0.128.0/24 to any -> (lagg0) round-robin I would have expected both "-a '*'" and "-a vm" to produce the same output. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-252617-227>