Why the same experiment with lo1 interface can be controlled by pf?Traffic never passes through the interface so PF is completely oblivious to it.
The same means 'the same conditions, but withThat's because lo1 is a different interface on the system. Just look at theifconfig
output, it certainly is not the same interface as your main network interface. If the traffic traverses across different interfaces PF is able to filter that traffic.
lo1
'cloned_interfaces="lo1"
ifconfig_lo1="inet 10.0.2.1 netmask 255.255.255.0 up"
ifconfig_lo1_alias0="inet 10.0.2.2 netmask 255.255.255.255"
ifconfig_lo1_alias1="inet 10.0.2.3 netmask 255.255.255.255"
ifconfig_lo1_alias2="inet 10.0.2.4 netmask 255.255.255.255"
ifconfig_lo1_alias3="inet 10.0.2.5 netmask 255.255.255.255"
ifconfig_lo1_alias4="inet 10.0.2.6 netmask 255.255.255.255"
ifconfig_lo1_alias5="inet 10.0.2.7 netmask 255.255.255.255"
ifconfig_lo1_alias6="inet 10.0.2.8 netmask 255.255.255.255"
ifconfig_lo1_alias7="inet 10.0.2.9 netmask 255.255.255.255"
block all
, no communication possible, I have to write rules likepass on $jail inet proto tcp from $jail:network to $j_database port 5432 no state # POSTGRESQL
pass on $jail inet proto tcp from $j_database port 5432 to $jail:network no state # POSTGRESQL
root@web:/ # telnet 10.0.2.3 5432
Trying 10.0.2.3...
Connected to database.abinet.ru.
Escape character is '^]'.
^]
telnet> quit
Connection closed.
abishai@abinet:~ % doas tcpdump -i lo1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo1, link-type NULL (BSD loopback), capture size 65535 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel
block in quick on $jail inet proto tcp from 10.0.2.4 to $j_database
root@web:/ # telnet 10.0.2.3 5432
Trying 10.0.2.3...
What solution can be for jails and em0 in the same /24 network with pf support? A bridge with lo1 and em0 ?As SirDice said, the em0 interface never receives those packets, therefore they do not get processed by PF. The only way a packet arrives on the NIC is over the wire.
The lo interface is purely software though, so PF does see packets sent via that interface.
pass in on $int_if inet proto tcp from $lan_webserver to $lan_database port postgresql