Solved Unable to delete pflog0

B

balanga

Apologies in advance for this newbie type question, but I only started using PF recently and initially it worked for my purposes. ie accessing the Internet from my LAN via a gateway.

For reasons unknown to me things stopped working and in an effort to see what is going wrong I'm trying to use pfctl to see what is happening but not getting very far.

In an effort to start again from scratch I see

Code: 
root@W520:~ $ ifconfig pflog0
pflog0: flags=1000141<UP,RUNNING,PROMISC,LOWER_UP> metric 0 mtu 33152
        options=0
        groups: pflog
root@W520:~ $
I am unable to delete this using ifconfig pflog0 destroy

Code: 
root@W520:~ $ ifconfig pflog0 destroy                                                                                                                                                                                                                                    
ifconfig: SIOCIFDESTROY: Invalid argument
root@W520:~ $

What do I need to do?
 
i don't think you can destroy that, nor do we understand what doing this would help fix. how is it failing? does pfctl -si show that pf is enabled?
 
atax1a said:
i don't think you can destroy that, nor do we understand what doing this would help fix. how is it failing? does pfctl -si show that pf is enabled?
Click to expand...
Basically I don't know what pflog0 is for or how it came about. I just want to get rid of it in case it interferes in some way with pf or pfctl.
 
it is a virtual interface where packets with the log keyword go. it does not interfere with anything, it is part of the pf system.

instead of trying to delete random things, can you explain what happens? how is it failing? is it enabled?
 
You probably enabled it with the line pflog_enable=YES in rc.conf, remove it or set it to NO and reboot or stop the service.

Also before deleting an interface you need to stop it. ifconfig pflog0 down
 
As was mentioned, the log does not affect the functionality of PF. It just creates a log file so that you can inspect how your ruleset behaves.

Speaking of which, could you show us your ruleset? cat /etc/pf.conf

If things are not working properly, the real culprit is almost definitely rule flow logic. Working on these things myself, so I'd be happy to help you thread through them to see what might be blocking the flow.
 
lost_in_c said:
As was mentioned, the log does not affect the functionality of PF. It just creates a log file so that you can inspect how your ruleset behaves.

Speaking of which, could you show us your ruleset? cat /etc/pf.conf

If things are not working properly, the real culprit is almost definitely rule flow logic. Working on these things myself, so I'd be happy to help you thread through them to see what might be blocking the flow.
Click to expand...
I was looking at pf log files to try and diagnose the problem that had occurred, but had completely misdiagnosed things.

This thread explains the situation.
 
Hardware in the sense that it was the USB interface causing the issue, for which a software time delay was a solution, rather than a case of misconcieved code, such as PF rules.
 
You must log in or register to reply here.
Back
Top