I am using ipf(8) on a machine running FreeBSD 13.0 (RELEASE-p5 #0 releng/13.0-2646dd665: Mon Jan 3 08:34:08 CST 2022). I am attempting to update the ipf rules using address pools but have an error that I cannot find a solution for.
From the man page ippool(5) an address pool can be defined either of two ways:
For maintainability and due to the number of entries in some of the address pools, I would like to use the second (newer) method. But when I copy the man page into files and attempt to load the pool, I get a syntax error
Has someone had the same problem or can tell me how to fix this?
From the man page ippool(5) an address pool can be defined either of two ways:
Code:
table role = ipf type = tree number = 100
{ 1.1.1.1/32; 2.2.0.0/16; !2.2.2.0/24; ef00::5/128; };
For the sake of clarity and to aid in managing large numbers of ad-
dresses inside address pools, it is possible to specify a location to
load the addresses from. To do this simply use a "file://" URL where
you would specify an actual IP address.
pool ipf/tree (name rfc1918;) { file:///etc/ipf/rfc1918; };
The contents of the file might look something like this:
# RFC 1918 networks
10.0.0.0/8
!127.0.0.0/8
172.16.0.0/12
192.168.0.0/24
For maintainability and due to the number of entries in some of the address pools, I would like to use the second (newer) method. But when I copy the man page into files and attempt to load the pool, I get a syntax error
Code:
[root@firewall ~]# ls /etc/ipf/
total 16
drwx------ 2 root wheel 512 Sep 10 15:10 ./
drwxr-xr-x 28 root wheel 2560 Sep 8 12:37 ../
-rw------- 1 root wheel 64 Sep 10 15:10 ippool.conf
-rw------- 1 root wheel 121 Sep 9 16:42 rfc1918
[root@firewall ~]# cat /etc/ipf/ippool.conf
pool ipf/tree (name rfc1918;) { file:///etc/ipf/rfc1918; };
[root@firewall ~]# cat /etc/ipf/rfc1918
# RFC 1918 networks
# format from ippool(5) man page - 192... range corrected
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
[root@firewall ~]# ippool -f /etc/ipf/ippool.conf -dv
loadpoolfile: opts = 0x42
syntax error error at "file", line 1*-
Has someone had the same problem or can tell me how to fix this?
Last edited by a moderator: