Jails: pf blocks access to localhost of host system

[Dave Cottlehuber]

On Mon, 16 Aug 2021, at 21:54, Valeri Galtsev wrote:
> Here if my simplified to necessary minimum for debugging pf.conf:

A very helpful trick for debugging pf rules is to temporarily switch to logging blocks, and then use tcpdump or wireshark on the pflog interface to show exactly which rule is blocking your traffic.

# use `block log all` temporarily in your pf.conf
$ sudo service pflog onestart
$ sudo tcpdump -i pflog0 -o -ttt -vv -e -n
... 
 00:00:00.000000 rule 6/0(match): block in on wlan0: (tos 0x0, ttl 28, id 10175, offset 0, flags [DF], proto TCP (6), length 52)
    18.135.227.37.443 > 172.17.29.35.41193: Flags [.], cksum 0xcd79 (correct), seq 2375471224, ack 432893548, win 8, options [nop,nop,TS val 2577574610 ecr 2828825691], length 0

in particular note the rule 6 listed. When you run `pfctl -vvv -f /etc/pf.conf | egrep '^@6 ' you'll see what rules those are, and then you can add a pass rule as appropriate from tcpdump info.

This would be a great addition to the handbook, I think. There is already `31.3. PF` which alludes to this but doesn't link all the bits together for a newcomer to pf.

Read pflog(4) and specifically this in pf.conf(5):

     log   In addition to the action specified,	a log message is generated.
	   Only	the packet that	establishes the	state is logged, unless	the no
	   state option	is specified.  The logged packets are sent to a
	   pflog(4) interface, by default pflog0.  This	interface is monitored
	   by the pflogd(8) logging daemon, which dumps	the logged packets to
	   the file /var/log/pflog in pcap(3) binary format.

You can attach logging to almost any rule in pf.conf, not just blocking ones.

Finally, remember to clean up pcap junk:

sudo service pflog onestop
sudo rm /var/log/pflog

As a general pointer, I tend to use `pass in  quick ...` for rules, I was once told that speeds things up but I forget the details.

https://home.nuug.no/~peter/pftutorial/ if you haven't already found it, is invaluable. There is a version somewhere with a freebsd specific section in it, if somebody has a link to this please share.

A+
Dave