https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=236221
Bug ID: 236221
Summary: pf: ruleset optimizaton doesn't create autotables for
rules into anchors
Product: Base System
Version: 12.0-RELEASE
Hardware: amd64
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: conf
Assignee: b...@freebsd.org
Reporter: a.kraso...@yahoo.com
I found out PF's ruleset optimization spoils rule into anchor. It replaces list
of addresses with autotable but doesn't create this one, so rule doesn't work.
I tested with the following configs:
# uname -a
FreeBSD test 12.0-RELEASE FreeBSD 12.0-RELEASE r341666 GENERIC amd64
# cat /etc/pf.conf
table <User2> persist { 10.10.12.49 }
table <NatFrom> persist { 10.10.12.49/24 }
nat on em0 from <NatFrom> to any -> { 192.168.170.199 }
anchor user_profiles in on { em1 } {
anchor User2 from <User2> {
block quick log from <User2> to {87.250.250.242, 74.125.131.94, 4.2.2.2,
8.8.8.8, 217.69.139.202, 81.19.82.10}
}
}
# cat /etc/rc.conf
hostname="test"
ifconfig_em0="inet 192.168.170.199 netmask 255.255.255.0"
defaultrouter="192.168.170.254"
ifconfig_em1="inet 10.10.12.1 netmask 255.255.255.0"
sshd_enable="YES"
dumpdev="NO"
zfs_enable="YES"
pf_enable="YES"
gateway_enable="YES"
You can see there is an autotable into the rule:
# pfctl -a 'user_profiles/*' -sr
anchor "User2" from <User2> to any {
block drop log quick inet from <User2> to <__automatic_c789788_0>
}
But there isn't autotable at all:
# pfctl -sTables
NatFrom
User2
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
