In pf_reload pfctl is called with severel flush parameters, but pfctl does only incorporate the last parameter: pfctl -Fnat -Fqueue -Frules -FSources -Finfo -FTables -Fosfp works like pfctl -Fosfp. Fix: pfctl -Fnat pfctl -Fqueue .. How-To-Repeat: /etc/rc.d/pf reload
Responsible Changed From-To: freebsd-bugs->freebsd-pf Over to maintainer(s).
I like to revise my proposal to fix pf_reload: Correct is pfctl -Fnat -Fqueue -Frules -FSources -Finfo -FTables -Fosfp works like pfctl -Fosfp. But instead of fixing this in pfctl or the pf script, this call of pfctl should be deleted completely. Otherwise running connections could be broken by pf_reload. In continuation of the patch given in PR 119874 I prefer now --- pf.orig 2015-03-13 12:00:34.000000000 +0100 +++ pf 2015-04-14 00:31:56.513032000 +0200 @@ -46,16 +46,13 @@ pf_check() { echo "Checking pf rules." - $pf_program -n -f "$pf_rules" + $pf_program -n -f "$pf_rules" $pf_flags } pf_reload() { echo "Reloading pf rules." - $pf_program -n -f "$pf_rules" || return 1 - # Flush everything but existing state entries that way when - # rules are read in, it doesn't break established connections. - $pf_program -Fnat -Fqueue -Frules -FSources -Finfo -FTables -Fosfp > /dev/null 2>&1 + $pf_program -n -f "$pf_rules" $pf_flags || return 1 $pf_program -f "$pf_rules" $pf_flags } Further we should avoid to break connections on skipped interfaces during reloading pf rules. The patch given in http://lists.freebsd.org/pipermail/freebsd-pf/2013-April/006994.html does this job and works in FreeBSD 10 too.
A commit references this bug: Author: kp Date: Wed Feb 28 08:53:07 UTC 2018 New revision: 330105 URL: https://svnweb.freebsd.org/changeset/base/330105 Log: pf: Do not flush on reload pfctl only takes the last '-F' argument into account, so this never did what was intended. Moreover, there is no reason to flush rules before reloading, because pf keeps track of the rule which created a given state. That means that existing connections will keep being processed according to the rule which originally created them. Simply reloading the (new) rules suffices. The new rules will apply to new connections. PR: 127814 Submitted by: Andreas Longwitz <longwitz at incore.de> MFC after: 3 weeks Changes: head/etc/rc.d/pf
A commit references this bug: Author: kp Date: Wed Mar 21 09:57:06 UTC 2018 New revision: 331288 URL: https://svnweb.freebsd.org/changeset/base/331288 Log: MFC 330105: pf: Do not flush on reload pfctl only takes the last '-F' argument into account, so this never did what was intended. Moreover, there is no reason to flush rules before reloading, because pf keeps track of the rule which created a given state. That means that existing connections will keep being processed according to the rule which originally created them. Simply reloading the (new) rules suffices. The new rules will apply to new connections. PR: 127814 Submitted by: Andreas Longwitz <longwitz at incore.de> Changes: _U stable/11/ stable/11/etc/rc.d/pf
A commit references this bug: Author: kp Date: Wed Mar 21 09:57:30 UTC 2018 New revision: 331289 URL: https://svnweb.freebsd.org/changeset/base/331289 Log: MFC 330105: pf: Do not flush on reload pfctl only takes the last '-F' argument into account, so this never did what was intended. Moreover, there is no reason to flush rules before reloading, because pf keeps track of the rule which created a given state. That means that existing connections will keep being processed according to the rule which originally created them. Simply reloading the (new) rules suffices. The new rules will apply to new connections. PR: 127814 Submitted by: Andreas Longwitz <longwitz at incore.de> Changes: _U stable/10/ stable/10/etc/rc.d/pf