Date: Thu, 15 May 2008 21:16:29 -0400 From: Tom Uffner <tom@uffner.com> To: Mark Pagulayan <m.pagulayan@auckland.ac.nz> Cc: freebsd-pf@freebsd.org Subject: Re: FreeBSD PF 4.1 Inserts Flags S/SA Automatically to rules Message-ID: <482CE06D.7070800@uffner.com> In-Reply-To: <C65291A68BAF57499B18564A1EE4A761370EE5@UXCHANGE1.UoA.auckland.ac.nz> References: <C65291A68BAF57499B18564A1EE4A761370E38@UXCHANGE1.UoA.auckland.ac.nz> <fee88ee40805141613k685c1536w9fc72e88aaa9f746@mail.gmail.com> <482B7BE6.9080608@uffner.com><C65291A68BAF57499B18564A1EE4A761370E53@UXCHANGE1.UoA.auckland.ac.nz><482B80D3.4010701@quis.cx><C65291A68BAF57499B18564A1EE4A761370E5A@UXCHANGE1.UoA.auckland.ac.nz> <482B9117.9070800@uffner.com> <C65291A68BAF57499B18564A1EE4A761370E7A@UXCHANGE1.UoA.auckland.ac.nz> <482C7056.7010809@uffner.com> <C65291A68BAF57499B18564A1EE4A761370EE5@UXCHANGE1.UoA.auckland.ac.nz>
next in thread | previous in thread | raw e-mail | index | archive | help
Mark Pagulayan wrote:
> Yes I am using net.link.bridge.pfil_member: 1. What is the effect of
> this on the bridge interface.
see if_bridge(4) for full details. in short they control whether or not
filtering is available on the member interfaces and/or the bridge.
net.link.bridge.pfil_local_phys: 0
net.link.bridge.pfil_member: 1
net.link.bridge.pfil_bridge: 1
net.link.bridge.pfil_onlyip: 1
> No there is no such rules below in my ruleset
> # is there a "set skip on {lo0, bridge0}" in here somewhere
>
> Is PF by default doing a filter on bridge0? What is the effect of this
> rule on the bridge?
i realized too late that you don't need one. i expected to see such a
rule due to my style of ruleset writing. i usually start w/ "block log all"
to disable the default pass rule on all interfaces, then explicitly
allow only the traffic i want.
you didn't, so the default for interfaces you don't have any rules for
is pass all.
"set skip on X" has the same effect as a rule that says "pass quick on X"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?482CE06D.7070800>