I'm running FreeBSD 10.3 p4 and observed some strange behaviorWhen restarting the machine pf starts due to /etc/rc.conf entry# JAILScloned_interfaces=${cloned_interfaces} lo1gateway_enable=YESipv6_gateway_enable=YES# OPENVPN -> jailscloned_interfaces=${cloned_interfaces} tun0# FIREWALLpf_enable=YESpf_rules=/etc/pf.conffail2ban_enable=YES# ... other services ...# load ezjailezjail_enable=YESbut ignores all rules concerning jails. So I have to reload rules manually to get it started bysudo pfctl -f /etc/pf.confMy pf.conf reads:#external interfaceext_if = bge0myserver_v4 = xxx.xxx.xxx.xxx# internal interfacesset skip on lo0set skip on lo1# nat all jailsjails_net = 127.0.1.1/24nat on $ext_if inet from $jails_net to any -> $ext_if# nat and redirect openvpnvpn_if = tun0vpn_jail = 127.0.1.2vpn_ports = {8080}vpn_proto = {tcp}vpn_network = 10.8.0.0/24vpn_network_v6 = fe80:dead:beef::1/64nat on $ext_if inet from $vpn_network to any -> $ext_ifrdr pass on $ext_if proto $vpn_proto from any to $myserver_v4 port $vpn_ports -> $vpn_jail# nsupdate jailnsupdate_jail=127.0.1.3nsupdate_ports={http, https}rdr pass on $ext_if proto {tcp} from any to $myserver_v4 port $nsupdate_ports -> $nsupdate_jail# ... other yails ...# block all incoming traffic#block in# pass out pass out# block fail2bantable <fail2ban> persistblock quick proto tcp from <fail2ban> to any port ssh# sshpass in on $ext_if proto tcp from any to any port ssh keep stateI had to disable blocking all incoming traffic as ssh via ipv6 stopped working.Any suggestions how to fix the problem?
Freebsd: pf firewall doesn't work on restart
freebsd;firewall;jails;pf
The problem here is that /etc/rc.d/pf runs before /usr/local/etc/rc.d/ezjail, so the kernel hasn't configured the jailed network by the time it tries to load the firewall rules. You might be tempted to alter the pf script to start after ezjail, but that's not a good idea - you want your firewall to start early in the boot process, but jails get started quite late on. service -r shows what order your rc scripts will run.You don't show any of your pf.conf rules, but my guess is that they use static interface configuration. Normally, hostname lookups and interface name to address translations are carried out when the rules are loaded. If a hostname or IP address changes, the rules need to be reloaded to update the kernel. However, you can change this behaviour by surrounding interface names (and any optional modifiers) in parentheses, which will cause the rules to update automatically if the interface's address changes. As a simple (and not very useful) example:ext_if=em0pass in log on $ext_if to ($ext_if) keep stateThe pf.conf manpage is very thorough. In particular, the PARAMETERS section is relevant here.