Hi,
Thanks for answering. Yes, I know that pf accepts rules mentioning inexistent
interfaces. What puzzles me here is that my ruleset is actually working.
With peer0 = 1.2.3.4 and peer1 = 5.6.7.8, the following ruleset works as
expected:
-----
peers = "{1.2.3.4, 5.6.7.8}"
set skip on lo
block all
# Allow IKE
pass in proto {tcp, udp} from $peers to self port isakmp
pass out proto {tcp, udp} from self to $peers port isakmp
# Allow ICMPv4 echo requests only through IPsec
pass in on enc0 proto icmp from $peers to self icmp-type echoreq
-----
If there is no SA, it is impossible for a peer to ping another. As soon
as IKE creates a SA, however, ping starts working. As you can see,
the last rule is explicitely bound to the inexistent enc0 interface, and
yet is working fine.
Thanks,
Marin.
21 mars 2017 03:30 "Kristof Provost" a écrit:
> On 20 Mar 2017, at 23:08, Marin Bernard wrote:
> > Yet, it appears that pf is able to handle references to enc(4) in its
> > ruleset
> > even if the kernel does not support it. Is it expected behaviour? Is
> > it
> > safe to use such a configuration on a production machine ?
> >
> pf accepts rules for interfaces that don’t exist (yet), so this is
> expected,
> but it won’t do what you want it to do.
>
> Regards,
> Kristof
_______________________________________________
freebsd-pf@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to "freebsd-pf-unsubscr...@freebsd.org"
