PF PF: block all does not prevent connection to vnet jailed server

[VladiBG]

Traffic between the bridge members is L2. You can enable filtering on bridge members first or use routing and filter ingress traffic on em0

 

[Ferocious1881]

Traffic between the bridge members are L2. You can enable filtering on bridge members first.

Or should I try to filter traffic from other computers to my jail's ip 10.0.0.10 based in interface selection. But maybe should try forgo the interface and see what happens.

 

[Kristof Provost]

you cannot usefully filter L2 traffic with pf.
If you want to filter traffic between the outside and your jail set it up as routed traffic, optionally with nat.
You cannot do this on bridged traffic with pf.

 

[VladiBG]

What if he enable "net.link.bridge.pfil_member" and then filter on em0?

 

[Ferocious1881]

you cannot usefully filter L2 traffic with pf.
If you want to filter traffic between the outside and your jail set it up as routed traffic, optionally with nat.
You cannot do this on bridged traffic with pf.

(1) Was not L2 Ethernet packages?
(2) There is not use to the device option?

 

[Kristof Provost]

What if he enable "net.link.bridge.pfil_member" and then filter on em0?

That contains many ambushes and should not be used.

If I were feeling particularly cruel I’d tell you to go look at the relevant code.

 

[VladiBG]

Thanks for the info. So it's better to setup routing or NAT and then filter the traffic on em0

 

[Ferocious1881]

Well apparently not even having

block drop quick inet from any to 10.0.0.10

prevents connection from another computer.