pf nuttyness

[Michael K. Smith - Adhost]

> -----Original Message-----
> From: owner-freebsd-questions at freebsd.org [mailto:owner-freebsd-
> questions at freebsd.org] On Behalf Of Brian McCann
> Sent: Tuesday, November 24, 2009 3:03 PM
> To: freebsd-questions
> Subject: pf nuttyness
> 
> I'm at the end of my rope here with PF.  I have a ruleset loaded, that
> is long and complicated...but I've shortened to to a "pass all" rule.
> The box has 4 interfaces, one for pfsync, one for me to connect to it,
> and two bridged interfaces.  The only traffic on the bridged
> interfaces is STP and IP multicast traffic from my EIGRP routers.
> When I run "pfctl -s rules -v", the EIGRP multicast traffic never hits
> any rules...yet it's allowed.
> 
> I'm on FreeBSD 7.1.
> 
> Has anyone else come across this before?  I'm ready to throw out
> FreeBSD 7.1 and try OpenBSD for pf use...which would be a shame since
> I use FreeBSD for all my other servers, and having 2 OpenBSD boxes
> would just be... weird...
> 
> --Brian
> 
For troubleshooting, try this:

Block in all log
(remove all other log statements)
tcpdump -n -e -ttt -i pflog0

That's provided you set up a pflog0 interface.  If not, add this to
rc.conf
pflog_enable="YES"
pflog_logfile="/var/log/pflog"

and 'ifconfig pflog0 up'

Mike