On Sat, Feb 20, 2021 at 04:17:11PM -0600, Eric Zylstra wrote:
> -But-
> make one simple change to filter on the bridge0 interface—
>
> pf.conf:
> filtered = "{ bridge0 }”
> not_filtered = "{ lo, dc0, em0, em1 }”
> block log on $filtered
> set skip on $not_filtered
>
> `doas pfctl -sr`
> block drop log on bridge0 all
>
> traffic is NOT blocked and everything flows right on through. (!?)
> `tcpdump -nettti pflog0` shows no packets being filtered.
>
> Am I overlooking something?
Perhaps this from bridge(4):
--8<--
NOTES
Bridged packets pass through pf(4) filters once as input on the receiving
interface and once as output on all interfaces on which they are
forwarded. In order to pass through the bridge packets must pass any in
rules on the input and any out rules on the output interface. Packets
may be blocked either entering or leaving the bridge.
-->8--
I partly recall a phrasing that I cannot find again now, unsure whether
it was from a manpage or from the FAQ; Something along: "Due to the
nature of bridged interfaces [...] you really have to understand this
very well to do [packet filtering] right".
Erling
