how to turn off pfsync globally
Michael Weiser
michael at weiser.dinsnail.net
Sun Jul 10 21:44:01 GMT 2005
Hello,
I'm having trouble silencing pfsync. It insists on broadcasting packets
like this
rule 38/0(match): block out on xl1: 10.10.1.2 > 0.0.0.0: pfsync 228
to the external network interface for every state change. Up until now I
circumvented that by adding the no-sync option to every rule. But since
I installed pftpx I get those broadcasts again, seemingly because
pftpx's dynamic rules don't have the no-sync option. Now I did another
hack and just said
ifconfig pfsync0 syncdev lo0
But this certainly isn't the right way to do it[tm].
Confusingly the pf documentation on www.openbsd.org says:
> By default, pfsync(4) does not send or receive state table updates on
> the network; however, updates can still be monitored using tcpdump(8) or
> other such tools on the local machine.
Why am I getting them on my external interface then?
How do I globally switch off pfsync if I don't need it?
Thanks in advance.
--
bye, Micha
More information about the freebsd-pf
mailing list