Date: Fri, 13 Apr 2012 05:36:40 +0200 From: Damien Fleuriot <ml@my.gd> To: Jason Hellenthal <jhellenthal@dataix.net> Cc: freebsd-pf@freebsd.org Subject: Re: PF - pf not loading non-persist tables from main ruleset on 8.3-PRERELEASE Message-ID: <CAE63ME7i3fyORKw2A4t6B6G4zL7qmqb1bBWTvCpbV%2BVJ-bjZTg@mail.gmail.com> In-Reply-To: <20120413030455.GA40140@DataIX.net> References: <CAE63ME7ZywicorwMC-3DTyBmRnO1ZLF2f_vjD_dNDnLM-TAgKQ@mail.gmail.com> <CAE63ME7d4jk-GPX2dnCqGvRV-uYm=ur_uci%2BaQ8UyzXZ7x9ghg@mail.gmail.com> <20120413030455.GA40140@DataIX.net>
next in thread | previous in thread | raw e-mail | index | archive | help
I've actually tried with the following, minimalist ruleset, and gotten
the same outcome.
Notice I included a rule of each type (nat, rdr, pass, block).
vlan31="vlan31"
vlan95="vlan95"
vlan710="vlan710"
table <tab_regular> { 192.168.1.1 }
table <tab_const> const { 192.168.2.2 }
table <tab_persist> persist { 192.168.3.3 }
set optimization aggressive
set loginterface $vlan95
set state-policy if-bound
set block-policy drop
set require-order yes
scrub in all no-df random-id
nat on $vlan31 inet from $vlan710:network to any -> 192.168.31.108
rdr pass on $vlan710 proto tcp from $vlan710 to any port 21 ->
127.0.0.1 port 8021
pass in quick on $vlan710
pass out
# Dummy load of the ruleset:
# pfctl -nvvvvf pf.conf
vlan31 = "vlan31"
vlan95 = "vlan95"
vlan710 = "vlan710"
table <tab_regular> { 192.168.1.1 }
table <tab_const> const { 192.168.2.2 }
table <tab_persist> persist { 192.168.3.3 }
set optimization aggressive
set loginterface vlan95
set state-policy if-bound
set block-policy drop
set require-order yes
@0 scrub in all no-df random-id fragment reassemble
@1 nat on vlan31 inet from 10.107.10.0/23 to any -> 192.168.31.108
@2 rdr pass on vlan710 inet proto tcp from 10.107.10.252 to any port =
ftp -> 127.0.0.1 port 8021
@3 pass in quick on vlan710 all flags S/SA keep state (if-bound)
@4 pass out all flags S/SA keep state (if-bound)
# After actual load:
# pfctl -sa
TRANSLATION RULES:
nat on vlan31 inet from 10.107.10.0/23 to any -> 192.168.31.108
rdr pass on vlan710 inet proto tcp from 10.107.10.252 to any port =
ftp -> 127.0.0.1 port 8021
FILTER RULES:
scrub in all no-df random-id fragment reassemble
pass in quick on vlan710 all flags S/SA keep state (if-bound)
pass out all flags S/SA keep state (if-bound)
No queue in use
INFO:
Status: Enabled for 0 days 00:00:35 Debug: Urgent
[ snip stats, timeouts and limits ]
TABLES:
tab_persist
Notice how again, PF only loads "persist" tables and not "const" and
regular ones.
uname -a, on amd64:
FreeBSD 8.3-PRERELEASE #0: Wed Apr 11 09:46:20 CEST 2012
I'm going to switch from RELENG_8 to RELENG_8_3 , update sources,
rebuild, and see if that helps.
On 13 April 2012 05:04, Jason Hellenthal <jhellenthal@dataix.net> wrote:
>
> Did you ever post your ruleset and example tables ? I don't think pf
> changed that much between 8.2-RELEASE to 8.3 as it stands now in the
> aspects that would effect this outcome.
>
> I am on 8.3-STABLE and the configuration of rules sounds similiar to
> yours but I am not exhibiting any problems. Rule order is also key here
> so be sure to check that.
>
>
> On Fri, Apr 13, 2012 at 03:39:44AM +0200, Damien Fleuriot wrote:
>> Sending to -pf since nobody in -stable seemed interested.
>>
>> Kindly let me know if I can be of assistance to track down the issue.
>>
>> For the record, a source update against RELENG_8 today (2012/04/12)
>> did not show any updated file regarding PF, so I guess this still is
>> an issue.
>>
>>
>> ---------- Forwarded message ----------
>> From: Damien Fleuriot <ml@my.gd>
>> Date: 12 April 2012 16:08
>> Subject: PF - pf not loading non-persist tables from main ruleset on
>> 8.3-PRERELEASE
>> To: freebsd-stable@freebsd.org
>>
>>
>> Hello list,
>>
>>
>>
>> I installed a box recently and updated it to 8.3-PRERELEASE on 2012/04/11
>>
>>
>> I'm experiencing this extremely weird behavior where PF refuses to
>> load standard and const table definitions from the main ruleset.
>> - persist tables load just fine
>> - normal and const tables inside anchors load just fine
>>
>>
>>
>> Does anyone else have the same problem ?
>>
>> I'll try to update the kernel again, you never know.
>> _______________________________________________
>> freebsd-pf@freebsd.org mailing list
>> http://lists.freebsd.org/mailman/listinfo/freebsd-pf
>> To unsubscribe, send any mail to "freebsd-pf-unsubscribe@freebsd.org"
>
> --
> ;s =;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAE63ME7i3fyORKw2A4t6B6G4zL7qmqb1bBWTvCpbV%2BVJ-bjZTg>