Date: Mon, 29 Jan 2007 08:42:35 -0500 From: Richard Coleman <rcoleman@criticalmagic.com> To: Pete French <petefrench@ticketswitch.com> Cc: freebsd-stable@freebsd.org Subject: Re: impossible rc.d ordering problem with stf and pf ? Message-ID: <45BDF9CB.8020903@criticalmagic.com> In-Reply-To: <E1HBVDo-0008WW-Fe@dilbert.ticketswitch.com> References: <E1HBVDo-0008WW-Fe@dilbert.ticketswitch.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Pete French wrote: >> 1) You use the interface name as address w/o dynamic lookup. >> i.e. "... from stf0 ..." > > Yes, thats it - I hadn't come across this 'dynamic lookup' thing before > though, so I didn't realise what it was. I still cant find it in the PF > manual, aside from a reference that you need to do it for NAT. > >> To 1 and 2 there is a simple sollution: Don't do that then! 1 can easily=20 >> be defused by adding parentheses. i.e. "... from (stf0) ...". > > pass out on (stf0) inet6 from any to any keep state > > Gives me a syntax error when I try and load it with pfctl. If I change > it to: > > pass out on stf0 inet6 from any to any keep state > > Then it works loading it with pfctl, but now does not work at boot due to > the lack of stf0 interface. :-( > > -pete. This confused me at first. But I believe you only use the dynamic syntax (stf0) in places where the interface name gets converted to an address or network, rather than just specifying an interface. So, for instance pass out on stf0 from (stf0) to any The way I found them all was to look at "pfctl -s rules" and look for the rules that had the ip address that was causing the problem. For me, this occurred in places where I used the interface name with "to", "from", and inside the "antispoof" rule. That fixed my problem with ppp and pf. Richard Coleman rcoleman@criticalmagic.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?45BDF9CB.8020903>