pfsync's syncpeer address is backwards

David Siebörger drs at
Mon Apr 10 07:46:08 UTC 2006

I've found that I need to specify the syncpeer IP address backwards for 
it to work.  Here's how my pfsync0 interface is configured:

root at bert# ifconfig pfsync0
pfsync0: flags=41<UP,RUNNING> mtu 1348
	pfsync: syncdev: vlan0 syncpeer: maxupd: 128

but the traffic is sent with the IP address the right way around:

root at bert# tcpdump -pni vlan0 proto pfsync
tcpdump: verbose output suppressed, use -v or -vv for full protocol 
listening on vlan0, link-type EN10MB (Ethernet), capture size 96 bytes
09:32:12.455049 IP >  pfsync 356
09:32:12.548227 IP >  pfsync 268
09:32:13.457113 IP >  pfsync 356
09:32:13.650316 IP >  pfsync 268

pfsync does work now, in that both firewalls are aware of state changes, 
but it would seem that either there's an extra or a missing hton/ntoh 
call somewhere in pfsync.

I'm running FreeBSD 6.1-RC (compiled from < 24h old source).  
The "hardware" configuration is a bit unusual, though: I'm using pfsync 
on vlan0, whose parent device is le1 in a VMware Server virtual 

Is anyone else seeing anything similar?

David Siebörger
drs at

More information about the freebsd-pf mailing list