pf and virtual interfaces

Arthur Chance freebsd at
Fri Jan 17 17:28:47 UTC 2014

The manual page for pf.conf contains the following snippet

set skip on ⟨ifspec⟩
      List interfaces for which packets should not be filtered.  Packets
      passing in or out on such interfaces are passed as if pf was dis‐
      abled, i.e. pf does not process them in any way.  This can be use‐
      ful on loopback and other virtual interfaces, when packet filtering
      is not desired and can have unexpected effects.

Does anyone know what the "unexpected effects" mentioned in the last 
sentence are? I ask because I'm currently working on a pf configuration 
that would be heavily filtering connections on a cloned loopback 
interface used to isolate service jails.

More information about the freebsd-questions mailing list