Am trying to solve a little problem with 'pf'. I have a ruleset which has some firewall rules for the IPv6 interface stf0. This works fine, except when I rreboot the machine, as the pf script is run before the network_ipv6 script - so stf0 does not exist. but I cannot work out how to arrange for stf0 to be created before the pf script is run - as network_ipv6 requires 'routing', but the pf script says it must be run before 'routing', if I am reading the 'REQUIRE' and 'BEFORE' lines correctly. Any solutions ? -pete.
On Sat, Jan 27, 2007 at 06:23:27PM +0000, Pete French wrote:> Am trying to solve a little problem with 'pf'. I have a ruleset which > has some firewall rules for the IPv6 interface stf0. This works fine, > except when I rreboot the machine, as the pf script is run before the > network_ipv6 script - so stf0 does not exist. but I cannot work out > how to arrange for stf0 to be created before the pf script is run - as > network_ipv6 requires 'routing', but the pf script says it must be run > before 'routing', if I am reading the 'REQUIRE' and 'BEFORE' lines > correctly. > > Any solutions ?Just a thought: Put the IPv6 specific rules in a separate file. Put a script in /usr/local/etc/rc.d that REQUIREs network_ipv6. In this script, use pfctl to load the IPv6 specific rules. Roland -- R.F.Smith http://www.xs4all.nl/~rsmith/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725) -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 187 bytes Desc: not available Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20070128/72a8881b/attachment.pgp
Pete French wrote:> Am trying to solve a little problem with 'pf'. I have a ruleset which > has some firewall rules for the IPv6 interface stf0. This works fine, > except when I rreboot the machine, as the pf script is run before the > network_ipv6 script - so stf0 does not exist. but I cannot work out > how to arrange for stf0 to be created before the pf script is run - as > network_ipv6 requires 'routing', but the pf script says it must be run > before 'routing', if I am reading the 'REQUIRE' and 'BEFORE' lines > correctly. >Just chiming in to confirm that this problem definitely exists. I don't have a solution, however, my IPv6 tunnels at home have all expired, so I may well get spare cycles to look at this the same time that I get spare cycles to revive the tunnels. BMS
On 12/23/-58 20:59, Pete French wrote:> Am trying to solve a little problem with 'pf'. I have a ruleset which > has some firewall rules for the IPv6 interface stf0. This works fine, > except when I rreboot the machine, as the pf script is run before the > network_ipv6 script - so stf0 does not exist. but I cannot work out > how to arrange for stf0 to be created before the pf script is run - as > network_ipv6 requires 'routing', but the pf script says it must be run > before 'routing', if I am reading the 'REQUIRE' and 'BEFORE' lines > correctly.Pete, I've played with that problems a few times. It's not a perfect solution, but you may create your own pf loading script and place it in /usr/local/etc/rc.d/. To make sure it's running late in startup, use a proper # REQUIRE: line. That way (and that what makes me saying it's not perfect) pf load script /etc/rc.d/pf is being run but aborts loading pf rules in first place and later (when rc is working though /usr/local/etc/rc.d/) pf rules are loaded by your custom script. HTH, Volker
> Date: Mon, 29 Jan 2007 12:02:52 +0000 > From: Pete French <petefrench@ticketswitch.com> > Subject: Re: impossible rc.d ordering problem with stf and pf ? > To: freebsd-stable@freebsd.org, max@love2party.net > Cc: rcoleman@criticalmagic.com, bms@freebsd.org > Message-ID: <E1HBVDo-0008WW-Fe@dilbert.ticketswitch.com> > > > 1) You use the interface name as address w/o dynamic lookup. > > i.e. "... from stf0 ..." > > Yes, thats it - I hadn't come across this 'dynamic lookup' thing before > though, so I didn't realise what it was. I still cant find it in the PF > manual, aside from a reference that you need to do it for NAT. > > > To 1 and 2 there is a simple sollution: Don't do that then! 1 can easily=20 > > be defused by adding parentheses. i.e. "... from (stf0) ...". > > pass out on (stf0) inet6 from any to any keep stateJust for my edification, what is the point of "keep state" on an "any-to-any" rule? Jim