Date: Sun, 11 Oct 2015 13:16:08 +0200 From: =?UTF-8?Q?Mi=C5=82osz_Kaniewski?= <milosz.kaniewski@gmail.com> To: freebsd-pf@freebsd.org Subject: Creating span interface using 'dup-to' option Message-ID: <CAC4mxp5ar-Kvp5238VRfKEL6FiVOg7XXzmv8fE-zdEFYRk7cAw@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
uname -a:
FreeBSD freebsd11_master.kvm 11.0-CURRENT FreeBSD 11.0-CURRENT #0 r285616:
Thu Jul 16 02:21:59 UTC 2015
root@releng2.nyi.freebsd.org:/usr/obj/usr/src/sys/GENERIC
amd64
+----------+ +-----------+ +----------+
| | em0| |em1 | |
| host1 +--------+ FreeBSD +--------+ host2 |
| | | | | |
+----------+ +-----------+ +----------+
|em2
|
|
v
Hi,
I have FreeBSD machine which forwards packets between host1 and host2. This
machine has also an additional interface (em2) which act as span interface
- all traffic between host1 and host2 is copied into it.
To achieve this scenario I can set bridge with em0 and em1 as members and
em2 as span interface. But I would like to get same result using pf
instead. So I tried to use this rules:
pass out on em0 dup-to em2 no state
pass out on em1 dup-to em2 no state
But it doesn't work. No packets appear on interface em2. I've checked same
configuration on OpenBSD and everything worked well.
Is there any difference in setting dup-to rule in FreeBSD and OpenBSD pf?
Thanks for help.
Best regards.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAC4mxp5ar-Kvp5238VRfKEL6FiVOg7XXzmv8fE-zdEFYRk7cAw>