`echo <something> | pfctl -mf -` overriding instead of modifying
Niklaas Baudet von Gersdorff
stdin at niklaas.eu
Wed May 18 07:24:11 UTC 2016
Note: crossposting in freebsd-questions and freebsd-pf
On a 10.3-RELEASE system, in my `/etc/pf.conf` I have the following lines:
ext_if="vtnet0"
...
rdr-anchor "jails/*" on $ext_if inet to $ext_if
In my `/etc/jail.conf` I have the following lines for some jail:
exec.poststart += "echo 'rdr pass on vtnet0 inet proto { udp tcp } to vtnet0 port domain -> $private_ip4' | pfctl -a 'jails/$name' -f -";
exec.poststart += "echo 'rdr pass on vtnet0 inet6 proto { udp tcp } to vtnet0 port domain -> $private_ip6' | pfctl -a 'jails/$name' -mf -";
Nonetheless, if I start the jail, only the inet6 rules will stay in the
appropriate anchor. The inet rules will be overridden.
Initially, I only used the `-f -` flags for pfctl (instead of `-mf -`) and
realised that making changes to the anchor overrides existing rules. So
I read pfctl(8) where it says
-m Merge in explicitly given options without resetting those
which are omitted. Allows single options to be modified without
disturbing the others:
# echo "set loginterface fxp0" | pfctl -mf -
So I thought that adding `-m` to the rule in the second `exec.poststart`
will include (instead of replace) the rules into the anchor. But this is
not the case. What am I doing wrong? Do I misunderstand `-m`?
Niklaas
More information about the freebsd-questions
mailing list