On Thu, Aug 13, 2009 at 05:31:39PM +0200, Henning Brauer wrote:
> > I'm suspecting that syntax b (interface)b in pf.conf only
> > resolves to the IPv4 addresses of the interface.
> wrong.
Right, thanks for this terse answer Henning (:
I investigated further, and found the cause of my problems to lie in the
fact that I was mentionning the address family in the rules.
Here are relevant excerpts of my pf.conf
ext_if="sis0"
...
block all
...
pass in on $ext_if proto tcp from any to ($ext_if) \
port ssh flags S/SA keep state
pass in on $ext_if inet6 proto tcp from any to ($ext_if) \
port ssh flags S/SA keep state
The (almost) duplication is due to my previously using a tunnel provided
by SixXS, thus having an additional interface only for IPv6. My ISP now
provides native IPv6, so I just s/sixxs_if/ext_if/g my configuration
file (yes, that's my way of bluntly copying).
To solve my problem, I replaced the duplicated rules by a single similar
one which does not specify any address family:
pass in on $ext_if proto tcp from any to ($ext_if) \
port ssh flags S/SA keep state
This now works like a charm.
What I don't understand, though, is why it wasn't working with the
original set of rules, as they look very similar to me, and I would have
expected them to achieve the same behavior, if not as efficiently.
What am I missing?
--
Olivier Mehani <sht...@ssji.net>
PGP fingerprint: 4435 CF6A 7C8D DD9B E2DE F5F9 F012 A6E2 98C6 6655
[demime 1.01d removed an attachment of type application/pgp-signature]
