From c449e01b9a7655dc51b2e90338167670c78e30d4 Mon Sep 17 00:00:00 2001 From: lgcosta Date: Wed, 11 Nov 2026 20:07:17 -0300 Subject: [PATCH] pf: emulate OpenBSD ingress/egress interface groups as any-interface (Linux has no ifgroups) --- module/pfsrc/pf_if.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/module/pfsrc/pf_if.c b/module/pfsrc/pf_if.c index 2431771..9c9947f 100644 --- a/module/pfsrc/pf_if.c +++ b/module/pfsrc/pf_if.c @@ -90,6 +90,17 @@ pfi_kif_alloc(const char *kif_name, int mflags) kif->pfik_flags |= PFI_IFLAG_ANY; kif->pfik_flags_new |= PFI_IFLAG_ANY; } + /* + * PFLINUX: OpenBSD creates the "ingress" and "egress" interface + * groups (ifgroups) automatically and both contain every interface; + * pf's direction (in/out ruleset) carries the actual meaning. Linux + * has no ifgroups, so emulate the groups as "any interface". + */ + if (!strcmp(kif->pfik_name, "ingress") || + !strcmp(kif->pfik_name, "egress")) { + kif->pfik_flags |= PFI_IFLAG_ANY; + kif->pfik_flags_new |= PFI_IFLAG_ANY; + } return (kif); }