pf.conf for wired and wireless interface (laptop)

[mefisto]

Greetings all,

on my laptop, the wired interface is assigned a static IP address, with a proper defaultroute entry in the /etc/mygate. The wireless interface is configured to be assigned a dynamic IP address via DHCP.

I have configured an /etc/hostname.trunk0:

trunkproto failover trunkport wired_if0
trunkport wireles_if0

to be used for definition of:

ext_if = "trunk0"

in /etc/pf.conf.

All seems to be working, until I unplug the wired interface, at which point the defaultroute disappears from the routing table and I am unable to reach the Internet.

Any ideas how to resolve the problem?

Kindest regards,

M

[jggimi]

You have a misconfigured trunk(4) device. It is the trunk pseudo-device which carries the shared IP address. The trunkports are not assigned IP addresses.

For failover between wired and wireless, they must be able to share the same IP address -- the wired and wireless Ethernet segments must be bridged to the same subnet.

[mefisto]

Hi jggimi,

thank you again for the answer.

Are you suggesting that I need to (1) remove the static address assignment form the wired_if0 and either (2) configure the /etc/hostname.trunk0 like:

trunkproto failover trunkport wired_if0
trunkport wireles_if0
dhcp

or (3) configure the /etc/hostname.trunk0 like:

trunkproto failover trunkport wired_if0
trunkport wireles_if0
inet 192.168.1.1 255.255.255.0

so that the tunk0 pseudo-device is assigned a single address?

If so, it appears that my goal of assigning a fixed IP address for the wired_if0 when I am on my home network and DHCP assigned address for the wireless_if0 when traveling is not achievable.

Let me ask a different question then. The primary motivation was that I do not have to modify the /etc/pf.conf every time the interface is switched because there is a danger that I forget. Is there another manner of achieving not having to modify the /etc/pf.conf?

Kindest regards,

M

[jggimi]

Originally Posted by mefisto

...I need to (1) remove the static address assignment form the wired_if0...

Yes. Any NIC used as a trunkport must not have any IP address assigned, and also must be marked active. This is typically done by provisioning a trunkport with a hostname.if(5) file that contains only the ifconfig keyword "up" - as in this example from one of my firewalls that uses IEEE 802.3ad static trunking:

description "<< Trunk port >>"
up

Then, you would configure the trunk NIC to either have a static IP address or a dynamic IP address, using either "dhcp" or "inet" as you used in your reply above.

If so, it appears that my goal of assigning a fixed IP address for the wired_if0 when I am on my home network and DHCP assigned address for the wireless_if0 when traveling is not achievable.

That isn't the purpose of a failover trunk. When a failover trunk is configured correctly, the user can switch between a primary (usually wired) and a backup (usually WiFi) physical segment that are bridged to the same LAN subnet, without loss of network sessions. That means one can move a laptop or netbook from a wired location on the LAN, and begin using WiFi on the same LAN, without stopping communication or changing IP addresses. This is different than any other form of trunk(4), as all of the others provide various means to achieve link aggregation over multiple physical links.

Let me ask a different question then. The primary motivation was that I do not have to modify the /etc/pf.conf every time the interface is switched because there is a danger that I forget. Is there another manner of achieving not having to modify the /etc/pf.conf?

Oh, absolutely. Just put parentheses around the external NICs in your pf.conf file. From the PF User's Guide, highlight mine:

The name of a network interface or group in parentheses ( ). This tells PF to update the rule if the IP address(es) on the named interface change. This is useful on an interface that gets its IP address via DHCP or dial-up as the ruleset doesn't have to be reloaded each time the address changes.

[mefisto]

Hi jggimi,

I think with you always setting me straight, I owe you a beer. Thank you.

Regarding you quote to the PF User's Guide, I am aware of change of the IP address on a (physical) interface, I am actually using this in my rules. But what I am asking is, what if the (physical) interface itself changes, from e.g., bge0 to ath. How do I deal with the need with re-defining the ext_if in /etc/pf.conf. Currently, I comment/uncomment them, but I tend to forget. . .

. . . 
ext _if = "bge"
#ext_if = "ath"
. . .

Kindest regards,

M

[jggimi]

There are many solutions. Here are four that come to mind.

1. Don't write rules associated with specific interfaces. Use addressing instead (from and/or to).
2. Use the egress group to define your external interfaces. The group's definition is any interface currently operating a default route.
3. Use lists of interfaces in your pass/block/match rules. PF will expand them into multiple rules, one per interface.
4. Use a failover trunk interface for the purpose of consolidating rules.

[mefisto]

Hi jggimi,

success. Thank you once again.

Kindest regards,

M