tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Connection closed when npf restarting with rules in non-default group



Consider the nfp rule definitions below.

    group default {
      block all apply "log"
      # Localhost loop
      pass final on lo0 all
      # IPv6 ICMP
      pass final family inet6 proto ipv6-icmp all
      # IPv4 pings
      pass in family inet4 proto icmp icmp-type echo all
      # DHCP
pass in family inet4 proto udp from any port bootps to any port bootpc pass in family inet6 proto udp from any to any port "dhcpv6-client"
      # SSH
      pass stateful in final family inet4 proto tcp to $ext_ip4 port ssh
      pass stateful in final family inet6 proto tcp to $ext_ip6 port ssh
      # Established outgoing connections
      pass stateful out final all
    }

There is no problem when npf is restarted with the command: 'service npf restart'

Now consider the same rules using a dedicated group.

    group "external" on wm0 {
      # SSH
      pass stateful in final family inet4 proto tcp to $ext_ip4 port ssh
      pass stateful in final family inet6 proto tcp to $ext_ip6 port ssh
    }

    group default {
      block all apply "log"
      # Localhost loop
      pass final on lo0 all
      # IPv6 ICMP
      pass final family inet6 proto ipv6-icmp all
      # IPv4 pings
      pass in family inet4 proto icmp icmp-type echo all
      # DHCP
pass in family inet4 proto udp from any port bootps to any port bootpc pass in family inet6 proto udp from any to any port "dhcpv6-client"
      # Established outgoing connections
      pass stateful out final all
    }

Restart the nfp service closes the SSH connection.


Home | Main Index | Thread Index | Old Index