tech-net archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Connection closed when npf restarting with rules in non-default group
Consider the nfp rule definitions below.
group default {
block all apply "log"
# Localhost loop
pass final on lo0 all
# IPv6 ICMP
pass final family inet6 proto ipv6-icmp all
# IPv4 pings
pass in family inet4 proto icmp icmp-type echo all
# DHCP
pass in family inet4 proto udp from any port bootps to any port
bootpc
pass in family inet6 proto udp from any to any port
"dhcpv6-client"
# SSH
pass stateful in final family inet4 proto tcp to $ext_ip4 port ssh
pass stateful in final family inet6 proto tcp to $ext_ip6 port ssh
# Established outgoing connections
pass stateful out final all
}
There is no problem when npf is restarted with the command: 'service npf
restart'
Now consider the same rules using a dedicated group.
group "external" on wm0 {
# SSH
pass stateful in final family inet4 proto tcp to $ext_ip4 port ssh
pass stateful in final family inet6 proto tcp to $ext_ip6 port ssh
}
group default {
block all apply "log"
# Localhost loop
pass final on lo0 all
# IPv6 ICMP
pass final family inet6 proto ipv6-icmp all
# IPv4 pings
pass in family inet4 proto icmp icmp-type echo all
# DHCP
pass in family inet4 proto udp from any port bootps to any port
bootpc
pass in family inet6 proto udp from any to any port
"dhcpv6-client"
# Established outgoing connections
pass stateful out final all
}
Restart the nfp service closes the SSH connection.
Home |
Main Index |
Thread Index |
Old Index