NPF: Not working like it should

[Christoph Kaegi]

Dear List

I am beginning to play with IPv6 and am also considering
switching from ipfilter to npf.

After reading the documentation at netbsd.org and the
manpage, I don't understand, why this doesnt work:

---------------------------- 8< ----------------------------
$EXTIF = ifnet(vr0)

procedure "log" {
log: npflog0
}

group (name "external", interface $EXTIF) {
pass stateful in final family inet proto tcp to $EXTIF port ssh
pass stateful out final all
block all apply "log"
}

group (default) {
pass final on lo0 all
block all
}
---------------------------- 8< ----------------------------

(ssh SYN packets get blocked and appear on npflog0)

... while this ruleset works: (same ruleset without 'port ssh')

---------------------------- 8< ----------------------------
$EXTIF = ifnet(vr0)

procedure "log" {
log: npflog0
}

group (name "external", interface $EXTIF) {
pass stateful in final family inet proto tcp to $EXTIF
pass stateful out final all
block all apply "log"
}

group (default) {
pass final on lo0 all
block all
}
---------------------------- 8< ----------------------------

Am I doing something wrong or is there a bug?

Thanks
Chris

[Christoph Kaegi]

Post by Christoph Kaegi
Dear List
I am beginning to play with IPv6 and am also considering
switching from ipfilter to npf.
After reading the documentation at netbsd.org and the

This is on 6.1_STABLE, LKM disabled, I should add.
And outgoing connections work.

Chris

[Petar Bogdanovic]

Post by Christoph Kaegi
$EXTIF = ifnet(vr0)

I'd say inet4() or inet6(), not ifnet().

Post by Christoph Kaegi
pass stateful in final family inet proto tcp to $EXTIF port ssh

inet4/inet6 instead of inet.