Date: Mon, 20 Jan 2020 16:16:29 +0100 From: Patrick Lamaiziere <patfbsd@davenulle.org> To: mike tancsa <mike@sentex.net> Cc: "freebsd-pf@freebsd.org" <freebsd-pf@freebsd.org> Subject: Re: automatic tables / self statement in pf.conf Message-ID: <20200120161629.7f5725d9@mr185033.univ-rennes1.fr> In-Reply-To: <5a989609-3366-bcc0-3e6f-d0ad29046f61@sentex.net> References: <5a989609-3366-bcc0-3e6f-d0ad29046f61@sentex.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 20 Jan 2020 09:37:36 -0500 mike tancsa <mike@sentex.net> wrote: > I have a process that runs every few min looking to see if the pf > rules changed on some of our firewalls.=C2=A0 On one customer unit, we > have a "self" statement and the script detected a change this > morning.=C2=A0 The rule reads >=20 > block log quick from <rejects> to self > block log quick from self to <rejects> >=20 > but when shown it looks like >=20 > block drop log quick inet from <rejects> to <__automatic_32a5c00f_0> > block drop log quick inet from <__automatic_32a5c00f_1> to <rejects> >=20 > I guess 'self' is treated like a table ? Yes. > The diff that got flagged > looked like >=20 > -block drop log quick inet from <rejects> to <__automatic_786310c4_0> > -block drop log quick inet from <__automatic_786310c4_1> to <rejects> > +block drop log quick inet from <rejects> to <__automatic_32a5c00f_0> > +block drop log quick inet from <__automatic_32a5c00f_1> to <rejects> >=20 > What would trigger the table name to change like that ?=09 I think that names of automatic tables are more or less random. I've got two firewalls using the same ruleset (pf.conf) and the name of the automatic table for self is not the same on both. I thing a simple pfctl -f will change the name. > Also, is there a better way to monitor pf rule changes ? I dont see > any mention in FreeBSD audit ? I don't know, may be the checksum changes when the ruleset changes ? # pfctl -vvvv -si No ALTQ support in kernel ALTQ related functions disabled Status: Enabled for 11 days 05:32:26 Debug: Urgent Hostid: 0x19478aad =3D=3D=3D> Checksum: 0x964f5ae9bc221aa840ba7323cb649e32 Interface Stats for all IPv4 IPv6 ... Regards,
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20200120161629.7f5725d9>