Re: FreeBSD 14 Firewall Passes ALL traffic!

On Fri Aug 8, 2025 at 6:51 PM CEST, Dan Lists wrote:
> On Fri, Aug 8, 2025 at 11:38 AM Souji Thenria <mail@souji-thenria.net>
> wrote:
>
>>
>> On 8. Aug 2025, at 18:13, Dan Lists <lists.dan@gmail.com> wrote:
>>
>> 
>> We have a transparent (bridged) firewall that we have been using since
>> around 2015, maybe earlier.
>>
>> After upgrading to FreeBSD 14 the firewall passes all traffic across the
>> bridge!  That is obviously VERY bad.
>>
>> The firewall does block traffic to the server itself, but not traffic
>> passing on the bridge interface.
>>
>> I've tested the exact same rules on FreeBSD 12 and 13 and they work fine.
>> I verified that the rules are the same, as well and the loaded kernel
>> modules.  I tried 14.0, 14.2, and 14.3 and all of them pass all traffic on
>> the bridge interface.
>>
>> I looked at the release notes and I did not see anything that would cause
>> this.
>>
>> I am at a loss on how to debug this.
>>
>> Please Help!
>>
>> Thanks
>>
>>
>>
>> Hi Dan,
>>
>> I hope this mail is not that badly formatted since I’m writing it on my
>> phone.
>>
>> There was a change. There is also a post in the FreeBSD forum [0]. Based
>> on that you need to set sysctl net.link.bridge.pfil_bridge=1.
>>
>> Regards,
>> Souji
>>
>> [0]
>> https://forums.freebsd.org/threads/pf-rule-not-working-after-upgrade-to-14-0.93874/
>>
>
> Sorry, I should have mentioned that I've tried setting that and it still
> doesn't work.
>
> I've tried some random things, and the problem seems to be using 'via
> <interface>'.
>
> I have  outside em1 <--> bridge0 <--> em2 outside.
>
> I have rules like  "ipfw add deny log tcp from any to IP in via em1".  The
> idea is that I can block incoming traffic but allow outbound connections
> with state.  If I remove "in via em1" or change it to "[in] via bridge0" it
> blocks incoming traffic but does not allow outbound traffic from IP.

I'm not familiar with ipfw. However, if I understand you correctly, your
firewall is not acting on the bridge interface itself, but rather on
both "real" interfaces. I feel like this should be fairly
straightforward.

Maybe you can post your firewall rules here, and someone with more
experience with ipfw can help.

-- 
Souji Thenria
Website: www.souji-thenria.net