Connection closed when npf restarting with rules in non-default group

Frédéric Fauberteau <[email protected]>
Newsgroups gmane.os.netbsd.devel.network
Organization The NetBSD Foundation
Message-ID <[email protected]>
Consider the nfp rule definitions below.

     group default {
       block all apply "log"
       # Localhost loop
       pass final on lo0 all
       # IPv6 ICMP
       pass final family inet6 proto ipv6-icmp all
       # IPv4 pings
       pass in family inet4 proto icmp icmp-type echo all
       # DHCP
       pass in family inet4 proto udp from any port bootps to any port 
bootpc
       pass in family inet6 proto udp from any to any port 
"dhcpv6-client"
       # SSH
       pass stateful in final family inet4 proto tcp to $ext_ip4 port ssh
       pass stateful in final family inet6 proto tcp to $ext_ip6 port ssh
       # Established outgoing connections
       pass stateful out final all
     }

There is no problem when npf is restarted with the command: 'service npf 
restart'

Now consider the same rules using a dedicated group.

     group "external" on wm0 {
       # SSH
       pass stateful in final family inet4 proto tcp to $ext_ip4 port ssh
       pass stateful in final family inet6 proto tcp to $ext_ip6 port ssh
     }

     group default {
       block all apply "log"
       # Localhost loop
       pass final on lo0 all
       # IPv6 ICMP
       pass final family inet6 proto ipv6-icmp all
       # IPv4 pings
       pass in family inet4 proto icmp icmp-type echo all
       # DHCP
       pass in family inet4 proto udp from any port bootps to any port 
bootpc
       pass in family inet6 proto udp from any to any port 
"dhcpv6-client"
       # Established outgoing connections
       pass stateful out final all
     }

Restart the nfp service closes the SSH connection.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.