https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=252617
Bug ID: 252617
Summary: pfctl -a '*' -sn does not recursively print
nat-anchors
Product: Base System
Version: 12.2-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Only Me
Priority: ---
Component: bin
Assignee: b...@freebsd.org
Reporter: gu...@kollerie.com
According to "man pfctl" one should use "-a '*'" to recursively print the
main ruleset. That does work for filter anchors (eg 'anchor') but not for
NAT anchors (eg 'nat-anchor').
Given the loaded ruleset:
ext_if="lagg0"
set skip on lo0
scrub in
nat-anchor vm
block in
pass out
pass in on $ext_if proto tcp from any to ($ext_if) port { ssh, domain,
http, https }
pass in on $ext_if proto udp to ($ext_if) port domain
pass in on $ext_if inet proto icmp to ($ext_if) icmp-type { unreach, redir,
timex, echoreq }
anchor vm
Running:
pfctl -a vm -f - <<EOT
nat on lagg0 from vm-public:network to any -> (lagg0)
pass in on vm-public
EOT
should load the new NAT and filter rules into the appropriate anchor
positions. When we run:
pfctl -a '*' -sr
The filter ruleset is properly recursively printed:
scrub in all fragment reassemble
block drop in all
pass in on lagg0 proto tcp from any to (lagg0) port = ssh flags S/SA keep
state
pass in on lagg0 proto tcp from any to (lagg0) port = domain flags S/SA
keep state
pass in on lagg0 proto tcp from any to (lagg0) port = http flags S/SA keep
state
pass in on lagg0 proto tcp from any to (lagg0) port = https flags S/SA keep
state
pass in on lagg0 proto udp from any to (lagg0) port = domain keep state
pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type unreach keep
state
pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type redir keep
state
pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type timex keep
state
pass in on lagg0 inet proto icmp from any to (lagg0) icmp-type echoreq keep
state
pass out all flags S/SA keep state
anchor "vm" all {
pass in on vm-public all flags S/SA keep state
}
But the NAT ruleset however is not:
pfctl -a '*' -sn
prints:
nat-anchor "vm" all
Only when we explicitly name the anchor, will the NAT ruleset be printed:
pfctl -a vm -sn
prints:
nat on lagg0 inet from 10.0.128.0/24 to any -> (lagg0) round-robin
I would have expected both "-a '*'" and "-a vm" to produce the same
output.
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
