Restaarting PF and its effects on jails and vms

[Odhiambo Washington]

On 24 March 2017 at 11:20, Arthur Chance <freebsd at qeng-ho.org> wrote:

> On 23/03/2017 18:29, James B. Byrne via freebsd-questions wrote:
> > I am revising the pf configuration for the FreeBSD-10.3 host of a
> > number of FreeBSD-11.0 BHyve instances. When I restart PF on the host
> > then traffic to a number of guests gets blocked even though the
> > ruleset says it should not be.
> >
> > Since the incoming ports for the blocked traffic appear to be from the
> > upper dynamic range I infer that this traffic is related to
> > connections established before PF was restarted and are now 'orphaned'
> > in consequence.  In other words, had the initial connection between
> > client anf service been made while PF was already running the traffic
> > being blocked following a restart would have been let through as being
> > part of an established connection.
> >
> > What is the recommended way of dealing with this issue when restarting
> > PF, if there is one?
>
> Don't restart pf, reload it. "service pf reload" goes to great lengths
> not to interfere with existing connections whereas "service pf restart"
> blows away everything before restarting.
>
> This is fresh in my mind because I made exactly the same mistake last
> week before remembering to reload. :-)
>

A quick one, before I get to RTFM, is there an equivalent 'reload' option
for pfctl (9.3-STABLE)?

-- 
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
"Oh, the cruft."