FreeBSD allows cloned interfaces such as bridges to be renamed to names that begin with a digit. For example: # ifconfig bridge create bridge0 # ifconfig bridge0 name 4igTLYjs # ifconfig 4igTLYjs 4igTLYjs: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500 description: test options=10<VLAN_HWTAGGING> ether 58:9c:fc:10:f8:0a id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15 maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200 root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0 bridge flags=0<> groups: bridge nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> However, pfctl appears to reject the same interface name when it is used as a dynamic interface-address reference in a PF NAT rule. For example: nat on 4igTLYjs from 10.0.0.0/24 to any -> (4igTLYjs) The interface name is accepted in the `on 4igTLYjs` portion of the rule, but appears to fail when referenced as `(4igTLYjs)`. Steps to reproduce: 1. Create a bridge interface: # ifconfig bridge create 2. Rename it to a name beginning with a digit: # ifconfig bridge0 name 4igTLYjs 3. Add the following PF rule: nat on 4igTLYjs from 10.0.0.0/24 to any -> (4igTLYjs) 4. Validate or load the ruleset: # pfctl -nf /etc/pf.conf Actual result: pfctl rejects or fails to parse the rule when the digit-prefixed interface name is used inside parentheses as a dynamic interface-address reference. Expected result: pfctl should consistently accept interface names that can exist on the system, including names beginning with digits, or the restriction should be documented and enforced consistently elsewhere. Notes: This creates a mismatch between the network interface layer and PF. Software that generates interface names automatically may create valid interface names accepted by ifconfig, but those names can later fail when used in PF NAT rules. This is especially easy to hit when using hash-derived interface names, since the generated name may occasionally begin with a digit.
I did some extra digging and found out that ifconfig accepts pretty much ANYTHING that fits in the character limit? ⭐: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500 options=10<VLAN_HWTAGGING> ether 58:9c:fc:10:13:a7 id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15 maxage 20 holdcnt 6 proto rstp maxaddr 2000 timeout 1200 root id 00:00:00:00:00:00 priority 0 ifcost 0 port 0 bridge flags=0<> groups: bridge nd6 options=9<PERFORMNUD,IFDISABLED> Is apparently valid, which when I pass through pf (nat on ⭐ from 10.0.0.0/24 to any -> (⭐)) gets me a cryptic "syntax error" instead of the semi-useful invalid interface..
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=4e7c1ff95a5187faee524055f22c4cf4134d1147 commit 4e7c1ff95a5187faee524055f22c4cf4134d1147 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-05-07 09:58:17 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-05-07 15:07:23 +0000 pfctl: relax interface name requirement The FreeBSD network stack, for better or worse, does not impose any requirements on interface names. As such it's valid for an interface name to start with a number (or indeed, be something like '⭐'). Allow this in pfctl, and add a test case for the specific case of interface names starting with a number. Note that we don't support UTF-8 names fully, so those may still fail. PR: 295064 MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") sbin/pfctl/parse.y | 2 +- tests/sys/netpfil/pf/names.sh | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 1 deletion(-)
Thank you for the quick fix!
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=9d0b771caa49eb77176d8f8cece8d1232dffe7f2 commit 9d0b771caa49eb77176d8f8cece8d1232dffe7f2 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-05-07 09:58:17 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-05-16 16:44:00 +0000 pfctl: relax interface name requirement The FreeBSD network stack, for better or worse, does not impose any requirements on interface names. As such it's valid for an interface name to start with a number (or indeed, be something like '⭐'). Allow this in pfctl, and add a test case for the specific case of interface names starting with a number. Note that we don't support UTF-8 names fully, so those may still fail. PR: 295064 MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 4e7c1ff95a5187faee524055f22c4cf4134d1147) sbin/pfctl/parse.y | 2 +- tests/sys/netpfil/pf/names.sh | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 1 deletion(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=e5536b061033bdc56cee7c1d42ab4fc17f5b8051 commit e5536b061033bdc56cee7c1d42ab4fc17f5b8051 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-05-07 09:58:17 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-05-14 19:04:19 +0000 pfctl: relax interface name requirement The FreeBSD network stack, for better or worse, does not impose any requirements on interface names. As such it's valid for an interface name to start with a number (or indeed, be something like '⭐'). Allow this in pfctl, and add a test case for the specific case of interface names starting with a number. Note that we don't support UTF-8 names fully, so those may still fail. PR: 295064 MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 4e7c1ff95a5187faee524055f22c4cf4134d1147) sbin/pfctl/parse.y | 2 +- tests/sys/netpfil/pf/names.sh | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 1 deletion(-)