From nobody Thu Oct 31 15:32:37 2024 X-Original-To: freebsd-net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4XfSg63xcyz5btDm for ; Thu, 31 Oct 2024 15:32:50 +0000 (UTC) (envelope-from girgen@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4XfSg6216Bz4JXK; Thu, 31 Oct 2024 15:32:50 +0000 (UTC) (envelope-from girgen@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1730388770; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/dp1qhmUk5Et1Apxlg/2rc7OFGd5zWuAkGexUOyCKWU=; b=odFqqXnb13Pl8SYJtp971wQIAel8nuJmWCY2X2wQo2eAf/zGREiks9KtQWBtTmw2jqsPE8 7LUdBoIXzfHQSRL7pCF1ANQgxqy5v/jJMTfhBi/tZKgY6+4iDPPCiILVlXEJM5T2UgFH2M c7yXiosHfIB16YwMPJ8xIpXLNwclIO0yI7qwq2noNHLReQ3fgWZOzpfnpgYMI6KtHeLpOs lKMDlqKhlWMEdYkCjIyV/QIR25vqS0ySXQNHeFRX0SAh+ezdq2zM4A4Si0IJhZlrn5raI5 Q2KP31E2m+QTBhlxT55O7/RAUlERrlHEO5RAia96q5zh7R3jFeFSf7ZMIewBpg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1730388770; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/dp1qhmUk5Et1Apxlg/2rc7OFGd5zWuAkGexUOyCKWU=; b=BWf9tqE9CbWHlqJxg9jYjithS+cNgrQBwY+zFt1i1JkKlGHxNF9QNl7FMMBQwcgcILUvtN K5+v2as8Rjy0XtPIuX8I7ms09sv5A+SUhyDG2lSjDUCvRC5+huay3jNqOI2fmL1dz5eR0m 4sZv7o6EEP1KfQ/5KTiOoZ2xA4yLwJSD9B2B+LM6THdjrF2UhJ1P58trwqjftSLiZ5OFvL YZAfhTJ2mjYlKoiG6zJMYMRHoJgBxgBuk63u8PWldzts0kW3SBwKHOCLSCpb3vMFe/5ExB Um6+bbCXvLG+hfm9w10vHibZsRPArhh1S3ghK1YOnMpUgXRs5fIag+a36NmzDg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1730388770; a=rsa-sha256; cv=none; b=muPrnqCb96vMglO87Y3QPp4CfMnvqycv1U4/FZSh1JiHtb2QrOA5v/BgK+9p7TSaPkuZKE KRae3QrUmV5f3n4aGK1BchXEuGdkP8OOlCv5y+jK+ZMjSSGa5ynCLYupEtwIcH5Xhh8+l5 4/8qg3eURoEJ0asOm4+aC/r7jaPM9UWDWZJH7gQ0f6ioOWNNz7t6fAU2qh8gv0BoXTwaXX Xv0F+V8aNbRAWHXVVnZCjQW9d6EkmIJjD+rUmlC34P9911dy7GOpJnMHabOx8eKA+vfKPW pyXpl7h0Ycv7H3RvVzWJEcX+EFkQwPAtz57KHq+RGrC+ZQJRHJKwHg7MY+sAhA== Received: from smtpclient.apple (31-211-209-78.customers.ownit.se [31.211.209.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) (Authenticated sender: girgen/mail) by smtp.freebsd.org (Postfix) with ESMTPSA id 4XfSg56JNRz160N; Thu, 31 Oct 2024 15:32:49 +0000 (UTC) (envelope-from girgen@FreeBSD.org) Content-Type: text/plain; charset=us-ascii List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@FreeBSD.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.200.121\)) Subject: Re: pf for netgraph jails? From: Palle Girgensohn In-Reply-To: <16E8EF1D-9CB0-4158-B0A4-FB4F91A03D2C@punkt.de> Date: Thu, 31 Oct 2024 16:32:37 +0100 Cc: "freebsd-net@freebsd.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <7D5BD9CC-8A08-4C74-B2E6-E0437235F3B1@FreeBSD.org> <16E8EF1D-9CB0-4158-B0A4-FB4F91A03D2C@punkt.de> To: "Patrick M. Hausen" X-Mailer: Apple Mail (2.3826.200.121) > 16 okt. 2024 kl. 18:17 skrev Patrick M. Hausen : >=20 > Hi! >=20 >> Am 16.10.2024 um 16:19 schrieb Palle Girgensohn : >> [...] >> but nothing happens, everything is passed directly into the jail: >>=20 >> nc -l 4444 (inside the jail) >>=20 >> and I can just telnet 1.2.3.4 4444 >=20 > Try: >=20 > sysctl net.link.bridge.pfil_member=3D0 > sysctl net.link.bridge.pfil_bridge=3D1 >=20 > Although I do not know if this ablies to netgraph or to if_bridge(4) = only. >=20 > But obviously your rules are not applied to the bridge interface. The = default > of the tunables above is the other way round - don't filter on bridge = interfaces. >=20 > HTH, > Patrick Hallo Patrick, Thanks for the reply. It seems that these MIBs are related to if_bridge, = not ng_bridge? I didn't have them at first, men after kldload if_bridge = they appeared. They make no difference, though, so perhaps they do not = relate to netgraph bridges? Any idea what tuneables would do the job? Thanks, Palle