[Bug 194925] New: [pf] [ifconfig] interface group keywords do not work by default

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Mon Nov 10 13:36:16 UTC 2014


            Bug ID: 194925
           Summary: [pf] [ifconfig] interface group keywords do not work
                    by default
           Product: Base System
           Version: 10.0-RELEASE
          Hardware: Any
                OS: Any
            Status: Needs Triage
          Severity: Affects Many People
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: feld at FreeBSD.org

pf offers the ability to use interface groups to build dynamic rules or to
simplify your ruleset. It also makes them more portable to other servers which
might have different interface names, etc. While testing my firewall with
FreeBSD instead of OpenBSD I was having a lot of trouble with my rules until I
identified that the group keywords were not working. 

>From FreeBSD's pf.conf(5):

     on <interface>
             This rule applies only to packets coming in on, or going out
             through, this particular interface or interface group.  For more
             information on interface groups, see the group keyword in
             ifconfig(8).  any will match any existing interface except
             loopback ones.

So our ifconfig needs to support groups, which it appears to do according to
our ifconfig(8):

     group group-name
             Assign the interface to a “group”.  Any interface can be in mul‐
             tiple groups.

             Cloned interfaces are members of their interface family group by
             default.  For example, a PPP interface such as ppp0 is a member
             of the PPP interface family group, ppp.

The problem appears to be that we do not have interfaces in groups by default.
OpenBSD has the following in their ifconfig(8):

                     Some interfaces belong to specific groups by default:

                     -       All interfaces are members of the all interface
                     -       Cloned interfaces are members of their interface
                             family group.  For example, a PPP interface such
                             as ppp0 is a member of the ppp interface family
                     -       pppx(4) interfaces are members of the pppx
                             interface group.
                     -       The interface(s) the default route(s) point to
                             are members of the egress interface group.
                     -       IEEE 802.11 wireless interfaces are members of
                             the wlan interface group.
                     -       Any interfaces used for network booting are
                             members of the netboot interface group.

As I learned the hard way, the following rule will not work without additional

pass in quick on egress inet proto tcp from any to (egress) port 80

If I manually add the egress keyword to an interface it appears to work, but
doesn't show up in ifconfig output. You have to explicitly request group
members which is confusing.

vm# ifconfig vtnet0 group egress
vm# ifconfig vtnet0
vtnet0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        ether 52:54:00:4e:65:cf
        inet netmask 0xffffff00 broadcast
        inet6 fe80::5054:ff:fe4e:65cf%vtnet0 prefixlen 64 scopeid 0x1
        inet6 2001:19f0:5c00:8014::64 prefixlen 64
        media: Ethernet 10Gbase-T <full-duplex>
        status: active
vm# ifconfig -g egress

vs OpenBSD's ifconfig output which clearly states the groups (except "all"):

$ ifconfig re0
        lladdr 00:0d:b9:34:19:5c
        description: charter
        priority: 0
        groups: egress
        media: Ethernet autoselect (1000baseT
        status: active
        inet netmask 0xfffffffc broadcast

The keywords do work once you manually add them to interfaces, but specifically
the concept of the "egress" and "ingress" keywords are defeated without them
being dynamically added to interfaces. It would be nice if we could improve the
ifconfig output and also dynamically add interfaces to some sane default

You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-bugs mailing list