Hello,
For the past 3 weeks I have been testing PF firewall and so far so good except for the rules not loading automatically on reboot.
I load the rules using
I did change my default kernel to accomodate altq
I actually had to redo the kernel because I rebooted once after attempting to change sysctl.conf for congestion algorithm change to htcp using:
And when the system came back up, the pf.conf rules did not load and when I manually loaded them pf could not recognize the altq line saying that they were not defined for my interfaces but I am not sure how that is possible since they worked before.
So I suspected that the issue was messing with sysctl.conf
I proceeded to revert and delete the sysctl.conf entry
Rebooted and still the same issue, so I proceeded to redo the kernel for the altq options and it worked, kind of
I still have to manually load the firewall rules
The steps I followed to build the custom kernel where from the manual:
THEN
Not sure if I missed a step on the custom kernel.
I suspected the reason that rules were not loaded was because I did not specify the directory where the rules are stored, so I
added it to /etc/rc.conf:
But that doesn't seem to be the issue either, especially because the manual says that by default pf knows to go to /etc/pf.conf
I did also try this on a vm in virtualbox since my desktop was not behaving as expected.
I followed the same steps as above except for adding the rules path:
And it works. Rules automatically get populated.
More info on my physical desktop/FW/router, for guidance:
For the past 3 weeks I have been testing PF firewall and so far so good except for the rules not loading automatically on reboot.
I load the rules using
pfctl -F all -f /etc/pf.conf and all works great.I did change my default kernel to accomodate altq
I actually had to redo the kernel because I rebooted once after attempting to change sysctl.conf for congestion algorithm change to htcp using:
Code:
net.inet.tcp.cc.algorithm=htcpSo I suspected that the issue was messing with sysctl.conf
I proceeded to revert and delete the sysctl.conf entry
Rebooted and still the same issue, so I proceeded to redo the kernel for the altq options and it worked, kind of
I still have to manually load the firewall rules
The steps I followed to build the custom kernel where from the manual:
Code:
# cd /usr/src/sys/amd64/conf
# cp GENERIC MYKERNEL
set new kernel options to the bottom of custom kernel:
options ALTQ
options ALTQ_CBQ # Class Based Queuing (CBQ)
options ALTQ_RED # Random Early Detection (RED)
options ALTQ_RIO # RED In/Out
options ALTQ_HFSC # Hierarchical Packet Scheduler (HFSC)
options ALTQ_PRIQ # Priority Queuing (PRIQ)
Code:
# cd /usr/src
# make buildkernel KERNCONF=MYKERNEL
# make installkernel KERNCONF=MYKERNEL
# rebootI suspected the reason that rules were not loaded was because I did not specify the directory where the rules are stored, so I
added it to /etc/rc.conf:
Code:
pf_enable="YES"
pf_rules="/etc/pf.conf"
pflog_enable="YES"
pflog_logfile="/var/log/pflog"I did also try this on a vm in virtualbox since my desktop was not behaving as expected.
I followed the same steps as above except for adding the rules path:
pf_rules="/etc/pf.conf"And it works. Rules automatically get populated.
More info on my physical desktop/FW/router, for guidance:
Code:
uname -a:
FreeBSD hostname12.2-RELEASE-p6 FreeBSD 12.2-RELEASE-p6 r369569 GENERIC amd64
altq rules:
#igb0 queue
altq on igb0 hfsc bandwidth 100Mb queue { one two three four }
queue one bandwidth 77% priority 10 qlimit 1000 hfsc (default)
queue two bandwidth 10% priority 9
queue three bandwidth 3% priority 1 hfsc (red)
queue four bandwidth 10% priority 0 hfsc (red)
#igb1 queue
altq on igb1 hfsc bandwidth 100Mb queue { five six seven }
queue five bandwidth 80% priority 10 qlimit 900 hfsc (default)
queue six bandwidth 7% priority 9 qlimit 200
queue seven bandwidth 5% priority 3
Code:
#cat /var/log/messages
syslogd: kernel boot file is /boot/kernel/kernel
kernel: ---<<BOOT>>---
kernel: Copyright (c) 1992-2020 The FreeBSD Project.
kernel: Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
kernel: The Regents of the University of California. All rights reserved.
kernel: FreeBSD is a registered trademark of The FreeBSD Foundation.
kernel: FreeBSD 12.2-RELEASE-p6 r369569 GENERIC amd64
