Date: Wed, 8 May 2024 23:19:59 +0200 From: Dirk-Willem van Gulik <dirkx@webweaving.org> To: Lexi Winter <lexi@le-fay.org> Cc: FreeBSD Hackers <freebsd-hackers@freebsd.org> Subject: Re: IPv6 and IPv4 combined rules in pf.conf Message-ID: <5258A000-3483-467F-8FE9-B3F986D62BB3@webweaving.org> In-Reply-To: <6005DECF-10AA-487F-8F95-317B4227E988@webweaving.org> References: <0C18B410-E90B-4295-B09E-43B48F9191A4@webweaving.org> <ZjvdI2LzAYEIMjCy@ilythia.eden.le-fay.org> <6005DECF-10AA-487F-8F95-317B4227E988@webweaving.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--Apple-Mail=_E7A94B88-4767-4051-AD41-387F9DEDB4CA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On 8 May 2024, at 22:41, Dirk-Willem van Gulik <dirkx@webweaving.org> = wrote: >=20 >> On 8 May 2024, at 22:14, Lexi Winter <lexi@le-fay.org> wrote: >>=20 >> Dirk-Willem van Gulik: >>> For dual stack hosts; with both an IPv4 and IPv6 CIDR that they are >>> listening to - is there a recommended way to setup pf.conf to avoid >>> mistakes/duplication ? >>=20 >>> To avoid duplication in constructs such as: >>=20 >>> # Foo app servers >>> foobarserver_host4=3D231.17.X.Y >>> foobarserver_host6=3Dfe80::5246:=E2=80=A6 >>>=20 >>> # Load balancers - direct or via tun0 in post/fail-back=20 >>> bar_net=3DX.Y.Z.Z #=20 >>> bar_net6=3Dfe80::5246:=E2=80=A6 #=20 >>> =E2=80=A6 >>>=20 >>> pass in on { tun0, $ext_if } proto udp from $bar_net to = $foobarserver_host4 port 2194 keep state >>> pass in on { tun0, $ext_if } proto udp6 from bar_net6 $var to = $foobarserver_host6 port 2194 keep state >>=20 >>> Is there some recommended way of doing this in stock FreeBSD ? Or = does >>> one usually end up with some sort of macro/generate style solution ? >>=20 >> i would suggest something like this: >>=20 >> table <foobarserver> { >> 231.17.X.Y >> fe80::5246:... >> } >>=20 >> table <bar-net> { >> ... >> } >>=20 >> pass on { tun0, $ext_if } proto udp from <bar-net> \ >> to <foobarserver> port 2194 >=20 > Ok - excellent - =C8=99o one can mix IPv4 and IPv6 in a list - and = =E2=80=98udp=E2=80=99 no longer needs to be =E2=80=98udp6=E2=80=99 (and = same for tcp6 and icmp6 v.s. tcp/icmp_=E2=80=94 pf guesses this right = based on the address ? Ignore - that works perfectly - with inet/inet6 thrown in where I need = to make the distinction. Thanks ! Dw. --Apple-Mail=_E7A94B88-4767-4051-AD41-387F9DEDB4CA Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;">On 8 May 2024, = at 22:41, Dirk-Willem van Gulik <dirkx@webweaving.org> = wrote:<div><blockquote type=3D"cite"><div><div style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><br><blockquote type=3D"cite"><div>On 8 May = 2024, at 22:14, Lexi Winter <lexi@le-fay.org> wrote:</div><br = class=3D"Apple-interchange-newline"><div><span style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline = !important;">Dirk-Willem van Gulik:</span><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><blockquote type=3D"cite" style=3D"font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;">For dual stack hosts; with both an IPv4 and IPv6 CIDR that they = are<br>listening to - is there a recommended way to setup pf.conf to = avoid<br>mistakes/duplication ?<br></blockquote><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><blockquote type=3D"cite" style=3D"font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;">To avoid duplication in constructs such as:<br></blockquote><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote = type=3D"cite" style=3D"font-family: Helvetica; font-size: 12px; = font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = class=3D"Apple-tab-span" style=3D"white-space: pre;"> </span># Foo app = servers<br><span class=3D"Apple-tab-span" style=3D"white-space: pre;"> = </span>foobarserver_host4=3D231.17.X.Y<br><span class=3D"Apple-tab-span" = style=3D"white-space: pre;"> = </span>foobarserver_host6=3Dfe80::5246:=E2=80=A6<br><br><span = class=3D"Apple-tab-span" style=3D"white-space: pre;"> </span># Load = balancers - direct or via tun0 in post/fail-back<span = class=3D"Apple-converted-space"> </span><br><span = class=3D"Apple-tab-span" style=3D"white-space: pre;"> = </span>bar_net=3DX.Y.Z.Z #<span = class=3D"Apple-converted-space"> </span><br><span = class=3D"Apple-tab-span" style=3D"white-space: pre;"> = </span>bar_net6=3Dfe80::5246:=E2=80=A6 #<span = class=3D"Apple-converted-space"> </span><br><span = class=3D"Apple-tab-span" style=3D"white-space: pre;"> = </span>=E2=80=A6<br><br><span class=3D"Apple-tab-span" = style=3D"white-space: pre;"> </span>pass in on { tun0, $ext_if } = proto udp from $bar_net to $foobarserver_host4 port 2194 = keep state<br><span class=3D"Apple-tab-span" style=3D"white-space: = pre;"> </span>pass in on { tun0, $ext_if } proto udp6 from = bar_net6 $var to $foobarserver_host6 port 2194 keep = state<br></blockquote><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><blockquote type=3D"cite" style=3D"font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;">Is there some recommended way of doing this in stock FreeBSD ? Or = does<br>one usually end up with some sort of macro/generate style = solution ?<br></blockquote><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><span style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline !important;">i would = suggest something like this:</span><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><span class=3D"Apple-tab-span" = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: pre; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"> = </span><span style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">table = <foobarserver> {</span><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><span class=3D"Apple-tab-span" = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: pre; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"> = </span><span class=3D"Apple-tab-span" style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"> </span><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">231.17.X.Y</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = class=3D"Apple-tab-span" style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"> </span><span class=3D"Apple-tab-span" style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"> </span><span style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline = !important;">fe80::5246:...</span><br style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><span class=3D"Apple-tab-span" = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: pre; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"> = </span><span style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">}</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = class=3D"Apple-tab-span" style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"> </span><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">table <bar-net> = {</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"><span class=3D"Apple-tab-span" style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"> </span><span class=3D"Apple-tab-span" style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"> </span><span style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none; float: none; display: inline = !important;">...</span><br style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><span class=3D"Apple-tab-span" = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: pre; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"> = </span><span style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; = font-size: 12px; font-style: normal; font-variant-caps: normal; = font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">}</span><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><br = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: normal; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"><span = class=3D"Apple-tab-span" style=3D"caret-color: rgb(0, 0, 0); = font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"> </span><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">pass on { tun0, $ext_if = } proto udp from <bar-net> \</span><br style=3D"caret-color: = rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: = normal; font-variant-caps: normal; font-weight: 400; letter-spacing: = normal; text-align: start; text-indent: 0px; text-transform: none; = white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; = text-decoration: none;"><span class=3D"Apple-tab-span" = style=3D"caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: = 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; = letter-spacing: normal; text-align: start; text-indent: 0px; = text-transform: none; white-space: pre; word-spacing: 0px; = -webkit-text-stroke-width: 0px; text-decoration: none;"> = </span><span class=3D"Apple-tab-span" style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; = font-variant-caps: normal; font-weight: 400; letter-spacing: normal; = text-align: start; text-indent: 0px; text-transform: none; white-space: = pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"> </span><span style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none; float: none; display: inline !important;">to <foobarserver> = port 2194</span><br style=3D"caret-color: rgb(0, 0, 0); font-family: = Helvetica; font-size: 12px; font-style: normal; font-variant-caps: = normal; font-weight: 400; letter-spacing: normal; text-align: start; = text-indent: 0px; text-transform: none; white-space: normal; = word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: = none;"></div></blockquote><div><br></div>Ok - excellent - =C8=99o one = can mix IPv4 and IPv6 in a list - and =E2=80=98udp=E2=80=99 no longer = needs to be =E2=80=98udp6=E2=80=99 (and same for tcp6 and icmp6 v.s. = tcp/icmp_=E2=80=94 pf guesses this right based on the address = ?</div></div></blockquote><br></div><div>Ignore - that works perfectly - = with inet/inet6 thrown in where I need to make the = distinction.</div><div><br></div><div>Thanks = !</div><div><br></div><div>Dw.</div><br></body></html>= --Apple-Mail=_E7A94B88-4767-4051-AD41-387F9DEDB4CA--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5258A000-3483-467F-8FE9-B3F986D62BB3>