8.2-RELEASE pf rules not loading

jhell jhell at DataIX.net
Sat Feb 26 02:48:51 UTC 2011

On Fri, 25 Feb 2011 17:31, freebsd@ wrote:
> On Fri, Feb 25, 2011 at 10:23:58PM +0000, Vincent Hoffman wrote:
>> On 25/02/2011 17:35, Josh Carroll wrote:
>>>> Hi All,
>>>>            Just upgraded my home machine to 8.2-RELEASE via
>>>> freebsd-update remotely (spare time at work.) and on reboot my pf
>>>> ruleset isnt being loaded. running '/etc/rc.d/pf start' once its booted
>>>> does start it fine though. Any suggestions on debugging or shall i just
>>>> try a verbose boot and watch the console when I get home?
>>>> I still have
>>>> pf_enable="YES"                  # Set to YES to enable packet filter (pf)
>>>> pflog_enable="YES"               # Set to YES to enable packet filter
>>>> logging
>>>> in /etc/rc.conf
>>> Is your interface dynamic (e.g. using DHCP)? If so, you might try changing:
>>> ifconfig_<ifacename>="DHCP"
>>> to
>>> ifconfig_<ifacename>="SYNCDHCP"
>>> It's possible the network hasn't come up properly yet or there is no
>>> IP assigned.
>>> Failing that, you can set:
>>> rc_debug="YES"
>>> in rc.conf then watch at boot time if there are any odd messages when
>>> it attempts to start pf.
>> It turns out that its sort of related to this. I have an IPv6 tunnel
>> from H.E. (tunnelbroker.net) and from looking at the boot output, it
>> looks like the IPv6 addresses (for any of my imterfaces) aren't applied
>> until after pf starts. I'd say this is a bug, Oddly this didnt happen
>> for the release candidate I tried, although I think I may have modified
>> my rules and not rebooted until I upgraded.
>> the rules in question are:
>> pass in quick on $gif_if inet6 proto udp to $ext_if port $udp_services
>> keep state
>> and
>> pass in quick on $gif_if inet6 proto tcp to $ext_if port $tcp_services
>> $sf_tcp
>> (ext_if = "ue0")
>> I'll try changing $ext_if to the ipv6 address and see if that helps.
> Please look at pf.conf(5) and search for the word "parentheses" (should
> be under the "from x to x" section.  This might resolve your problem.

Adding to this and as someone else has already advised in a different way 
is to use synchronous_dhclient="YES" in rc.conf(5) will most likely result 
in your rules loading properly.



More information about the freebsd-stable mailing list