pf and virtual interfaces
Arthur Chance
freebsd at qeng-ho.org
Fri Jan 17 17:28:47 UTC 2014
The manual page for pf.conf contains the following snippet
set skip on ⟨ifspec⟩
List interfaces for which packets should not be filtered. Packets
passing in or out on such interfaces are passed as if pf was dis‐
abled, i.e. pf does not process them in any way. This can be use‐
ful on loopback and other virtual interfaces, when packet filtering
is not desired and can have unexpected effects.
Does anyone know what the "unexpected effects" mentioned in the last
sentence are? I ask because I'm currently working on a pf configuration
that would be heavily filtering connections on a cloned loopback
interface used to isolate service jails.
More information about the freebsd-questions
mailing list