From owner-freebsd-stable@FreeBSD.ORG Fri Feb 25 22:45:04 2011 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 809EA1065670 for ; Fri, 25 Feb 2011 22:45:04 +0000 (UTC) (envelope-from vince@unsane.co.uk) Received: from unsane.co.uk (unsane-pt.tunnel.tserv5.lon1.ipv6.he.net [IPv6:2001:470:1f08:110::2]) by mx1.freebsd.org (Postfix) with ESMTP id DFEC48FC08 for ; Fri, 25 Feb 2011 22:45:03 +0000 (UTC) Received: from vhoffman-macbooklocal.local ([10.10.10.191]) (authenticated bits=0) by unsane.co.uk (8.14.4/8.14.4) with ESMTP id p1PMj2a5053035 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO) for ; Fri, 25 Feb 2011 22:45:02 GMT (envelope-from vince@unsane.co.uk) Message-ID: <4D6830EE.9090803@unsane.co.uk> Date: Fri, 25 Feb 2011 22:45:02 +0000 From: Vincent Hoffman User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7 MIME-Version: 1.0 To: freebsd-stable@freebsd.org References: <4D67E2BC.6070202@unsane.co.uk> <4D682BFE.9050702@unsane.co.uk> <20110225223119.GA13109@icarus.home.lan> In-Reply-To: <20110225223119.GA13109@icarus.home.lan> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: 8.2-RELEASE pf rules not loading X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Feb 2011 22:45:04 -0000 On 25/02/2011 22:31, Jeremy Chadwick wrote: > On Fri, Feb 25, 2011 at 10:23:58PM +0000, Vincent Hoffman wrote: >> On 25/02/2011 17:35, Josh Carroll wrote: >>>> Hi All, >>>> Just upgraded my home machine to 8.2-RELEASE via >>>> freebsd-update remotely (spare time at work.) and on reboot my pf >>>> ruleset isnt being loaded. running '/etc/rc.d/pf start' once its booted >>>> does start it fine though. Any suggestions on debugging or shall i just >>>> try a verbose boot and watch the console when I get home? >>>> I still have >>>> >>>> pf_enable="YES" # Set to YES to enable packet filter (pf) >>>> pflog_enable="YES" # Set to YES to enable packet filter >>>> logging >>>> >>>> in /etc/rc.conf >>> Is your interface dynamic (e.g. using DHCP)? If so, you might try changing: >>> >>> ifconfig_="DHCP" >>> >>> to >>> >>> ifconfig_="SYNCDHCP" >>> >>> It's possible the network hasn't come up properly yet or there is no >>> IP assigned. >>> >>> Failing that, you can set: >>> >>> rc_debug="YES" >>> >>> in rc.conf then watch at boot time if there are any odd messages when >>> it attempts to start pf. >>> >> It turns out that its sort of related to this. I have an IPv6 tunnel >> from H.E. (tunnelbroker.net) and from looking at the boot output, it >> looks like the IPv6 addresses (for any of my imterfaces) aren't applied >> until after pf starts. I'd say this is a bug, Oddly this didnt happen >> for the release candidate I tried, although I think I may have modified >> my rules and not rebooted until I upgraded. >> the rules in question are: >> >> pass in quick on $gif_if inet6 proto udp to $ext_if port $udp_services >> keep state >> and >> pass in quick on $gif_if inet6 proto tcp to $ext_if port $tcp_services >> $sf_tcp >> (ext_if = "ue0") >> >> I'll try changing $ext_if to the ipv6 address and see if that helps. > Please look at pf.conf(5) and search for the word "parentheses" (should > be under the "from x to x" section. This might resolve your problem. That seems looks reasonable, if unexpected since its all statically configured. I'll give it a try when I can reboot it next. It does seems a little odd that the rcorder doesnt start network_ipv6 (REQUIRE: routing) until after pf (BEFORE: routing) , but I assume there was a reason for this. Vince