Re: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules

Mark Pagulayan wrote:
> Yes I am using net.link.bridge.pfil_member: 1. What is
the effect of
> this on the bridge interface. 

see if_bridge(4) for full details. in short they control
whether or not
filtering is available on the member interfaces and/or the
bridge.

net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 1
net.link.bridge.pfil_bridge: 1
net.link.bridge.pfil_onlyip: 1

> No there is no such rules below in my ruleset
> # is there a "set skip on {lo0, bridge0}" in
here somewhere
> 
> Is PF by default doing a filter on bridge0? What is the
effect of this
> rule on the bridge? 

i realized too late that you don't need one. i expected to
see such a
rule due to my style of ruleset writing. i usually start w/
"block log all"
to disable the default pass rule on all interfaces, then
explicitly
allow only the traffic i want.

you didn't, so the default for interfaces you don't have any
rules for
is pass all.

"set skip on X" has the same effect as a rule that
says "pass quick on X"
_______________________________________________
freebsd-pffreebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to
"freebsd-pf-unsubscribefreebsd.org"

Hi Tom,

Thanks heaps for the advice

I will review and reorganize our ruleset. 

Cheers, 

Mark

-----Original Message-----
From: Tom Uffner [mailto:tomuffner.com] 
Sent: Friday, 16 May 2008 1:16 p.m.
To: Mark Pagulayan
Cc: freebsd-pffreebsd.org
Subject: Re: FreeBSD PF 4.1 Inserts Flags S/SA Automatically
to rules

Mark Pagulayan wrote:
> Yes I am using net.link.bridge.pfil_member: 1. What is
the effect of
> this on the bridge interface. 

see if_bridge(4) for full details. in short they control
whether or not
filtering is available on the member interfaces and/or the
bridge.

net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 1
net.link.bridge.pfil_bridge: 1
net.link.bridge.pfil_onlyip: 1

> No there is no such rules below in my ruleset
> # is there a "set skip on {lo0, bridge0}" in
here somewhere
> 
> Is PF by default doing a filter on bridge0? What is the
effect of this
> rule on the bridge? 

i realized too late that you don't need one. i expected to
see such a
rule due to my style of ruleset writing. i usually start w/
"block log
all"
to disable the default pass rule on all interfaces, then
explicitly
allow only the traffic i want.

you didn't, so the default for interfaces you don't have any
rules for
is pass all.

"set skip on X" has the same effect as a rule that
says "pass quick on
X"
_______________________________________________
freebsd-pffreebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to
"freebsd-pf-unsubscribefreebsd.org"