impossible rc.d ordering problem with stf and pf ?

[Richard Coleman]

Pete French wrote:
>> 1) You use the interface name as address w/o dynamic lookup.
>> i.e. "... from stf0 ..."
> 
> Yes, thats it - I hadn't come across this 'dynamic lookup' thing before 
> though, so I didn't realise what it was. I still cant find it in the PF
> manual, aside from a reference that you need to do it for NAT.
> 
>> To 1 and 2 there is a simple sollution: Don't do that then!  1 can easily=20
>> be defused by adding parentheses. i.e. "... from (stf0) ...".
> 
> 	pass out on (stf0) inet6 from any to any keep state
> 
> Gives me a syntax error when I try and load it with pfctl. If I change
> it to:
> 
> 	pass out on stf0 inet6 from any to any keep state
> 
> Then it works loading it with pfctl, but now does not work at boot due to
> the lack of stf0 interface. :-(
> 
> -pete.

This confused me at first.  But I believe you only use the dynamic syntax (stf0) in places where the 
interface name gets converted to an address or network, rather than just specifying an interface. 
So, for instance

pass out on stf0 from (stf0) to any

The way I found them all was to look at "pfctl -s rules" and look for the rules that had the ip 
address that was causing the problem.  For me, this occurred in places where I used the interface 
name with "to", "from", and inside the "antispoof" rule.

That fixed my problem with ppp and pf.

Richard Coleman
rcoleman at criticalmagic.com