pf and virtual interfaces
    Arthur Chance 
    freebsd at qeng-ho.org
       
    Fri Jan 17 17:28:47 UTC 2014
    
    
  
The manual page for pf.conf contains the following snippet
set skip on ⟨ifspec⟩
      List interfaces for which packets should not be filtered.  Packets
      passing in or out on such interfaces are passed as if pf was dis‐
      abled, i.e. pf does not process them in any way.  This can be use‐
      ful on loopback and other virtual interfaces, when packet filtering
      is not desired and can have unexpected effects.
Does anyone know what the "unexpected effects" mentioned in the last 
sentence are? I ask because I'm currently working on a pf configuration 
that would be heavily filtering connections on a cloned loopback 
interface used to isolate service jails.
    
    
More information about the freebsd-questions
mailing list