View Single Post
  #1   (View Single Post)  
Old 23rd November 2015
jasonvp's Avatar
jasonvp jasonvp is offline
Real Name: Jason
Port Guard
Join Date: Nov 2015
Location: Northern VA
Posts: 15
Default PF: Help With Tables vs Macros

Hey gang -

I posted this over on the forums, and figured I'd post it here, too. I just built a new server running FreeBSD 10.2 and locked it down with pf. After spinning up a bunch of jails (sendmail over here, named over there, a few web servers here and there, etc) I punched holes in the pf.conf to allow traffic to and from them. I did so using macros in the /etc/pf.conf file.

All good.

A few of the macros allow a range of loopbacks to talk to one another so that the jails can actually communicate internally with themselves. Meaning: jail1 can talk to jail1 via its loopback. Jail2 can talk to jail2 via it's loopback, etc.

# IPv4 and v6 loopbacks
ipv4_loopback = "{ }"
ipv6_loopback = "{ ::/64 }"
pass in quick from $ipv4_loopback to $ipv4_loopback
pass in quick from $ipv6_loopback to $ipv6_loopback
And as a test, I have a sendmail milter installed on one of my jails that its sendmail talks to via That works.

I tried to get tricky and convert the macros over to tables, like so:
# IPv4 and v6 loopbacks
table <ipv4_loopback> const {}
table <ipv6_loopback> const {::/64}
# Local loop to loop allows
pass in quick from <ipv4_loopback> to <ipv4_loopback>
pass in quick from <ipv6_loopback> to <ipv6_loopback>
Once I did that and loaded the new rules, sendmail on that aforementioned jail could no longer talk to its local ( milter. I even tried to telnet to the milter's port on the jail and no luck. Reverting the pf rules back to macros worked.

So: I clearly don't understand the use of tables vs macros. Any guidance? Calling me an idiot is perfectly acceptable here if I'm doing something drastically stupid.

Reply With Quote