I'm using the
eg.
(this machine is a gateway, I don't want to match forwarded packets)
The problem is (I think, couldn't find any bit of documentation about that)
Can anyone confirm my hypothesis about
I could add
Like telling the kernel to re-expand the rules every time an interface changes its IPs or something.
self keyword so I don't have to hardcode my adresseseg.
Code:
pass in proto tcp to self port 22The problem is (I think, couldn't find any bit of documentation about that)
self is only expanded when loading the rules, and never updated... which means if I bring a new interface up it won't accept traffic unless I reload the rules.Can anyone confirm my hypothesis about
self's behavior?I could add
pfctl -f /etc/pf.conf in all my post-up scripts (that's my workaround for now), but I was wondering if there's a better way to do this?Like telling the kernel to re-expand the rules every time an interface changes its IPs or something.