Re: 12.0-BETA1 vnet with pf firewall

From: Bjoern A. Zeeb <bzeeb-lists_at_lists.zabbadoz.net>
Date: Sun, 28 Oct 2018 15:50:46 +0000
On 28 Oct 2018, at 15:31, Ernie Luzar wrote:

> Tested with host running ipfilter and vnet running pf. Tried loading 
> pf from host console or from vnet console using kldload pf.ko command 
> and get this error message;
>
> linker_load_file: /boot/kernel/pf.ko-unsupported file type.
>
> Looks like the 12.0 version of pf which is suppose to work in vnet 
> independent of what firewall is running on the host is not working.

You cannot load pf from inside a jail (with or without vnet).  Kernel 
modules are global objects loaded from the base system or you compile 
the devices into the kernel;  it is their state which is virtualised.

If you load multiple firewalls they will all be available to the base 
system and all jails+vnet.  Whichever you configure in which one is up 
to you.  Just be careful as an unconfigured firewall might have a 
default action affecting the outcome of the overall decision.

For example you could have:

a base system using ipfilter and setting pf to default accept everything
and a jail+vnet using pf and setting ipfilter there to accept 
everything.


Hope that clarifies some things.

/bz
Received on Sun Oct 28 2018 - 14:50:54 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:41:19 UTC