Quote from: silmarine on June 29, 2026, 09:32:37 AM[...] if I put in any predefined interface net alias into a rule it will allow all the networks from the interfaces in the rules. So if I have a floating rule with interfaceA and interfaceB, sources as exact-host-from-interfaceA-network and the predefined interfaceB net alias, then the rule will still match traffic from interfaceA from any host in that network, instead of just the exact-host-from-interfaceA-network.
# [prio: 200000]
pass in quick on vlan0.1030 inet from $HOSTS_MGMT to {any} keep state label "e92ba5aa-e088-4435-8244-1410fd42334b" # test
pass in quick on vlan0.1040 inet from $HOSTS_MGMT to {any} keep state label "e92ba5aa-e088-4435-8244-1410fd42334b" # test
pass in quick on vlan0.1030 inet from {(vlan0.1040:network)} to {any} keep state label "e92ba5aa-e088-4435-8244-1410fd42334b" # test
pass in quick on vlan0.1040 inet from {(vlan0.1040:network)} to {any} keep state label "e92ba5aa-e088-4435-8244-1410fd42334b" # test
Quote from: Bob.Dig on June 29, 2026, 05:53:22 PMThey have, in pfSense.
Quote from: pfry on June 29, 2026, 02:22:07 AMEdit: For the heck of it (quoting myself), you might try "netstat" - "-m", "-i", perhaps "-Q", "-T", "-x", "-s" options (most have to be issued separately), and see if anything looks bad. I'm not sure if these will provide useful data for a PPPoE device.
Quote from: meyergru on June 29, 2026, 09:14:29 AMDid you use the Realtek vendor or the FreeBSD native driver on OpnSense?I'm using os-realtek-re drivers. The card plugged in without those didn't even show the interfaces on the GUI. I had "pci3: <network, ethernet> at device 0.0 (no driver attached"
=== netstat -Q ===
Configuration:
Setting Current Limit
Thread count 4 4
Default queue limit 256 10240
Dispatch policy deferred n/a
Threads bound to CPUs enabled n/a
Protocols:
Name Proto QLimit Policy Dispatch Flags
ip 1 1000 cpu hybrid C--
igmp 2 256 source default ---
rtsock 3 256 source default ---
arp 4 256 source default ---
ether 5 256 cpu direct C--
ip6 6 1000 cpu hybrid C--
ip_direct 9 256 cpu hybrid C--
ip6_direct 10 256 cpu hybrid C--
Workstreams:
WSID CPU Name Len WMark Disp'd HDisp'd QDrops Queued Handled
0 0 ip 0 29 0 7688 0 101826 109514
0 0 igmp 0 0 0 0 0 0 0
0 0 rtsock 0 0 0 0 0 0 0
0 0 arp 0 1 0 0 0 33 33
0 0 ether 0 0 5905 0 0 0 5905
0 0 ip6 0 1 0 0 0 1 1
0 0 ip_direct 0 0 0 0 0 0 0
0 0 ip6_direct 0 0 0 0 0 0 0
1 1 ip 0 18 0 4310 0 64904 69211
1 1 igmp 0 0 0 0 0 0 0
1 1 rtsock 0 0 0 0 0 0 0
1 1 arp 0 2 0 0 0 10006 10006
1 1 ether 0 0 718 0 0 0 718
1 1 ip6 0 1 0 0 0 10 10
1 1 ip_direct 0 0 0 0 0 0 0
1 1 ip6_direct 0 0 0 0 0 0 0
2 2 ip 0 83 0 26970 0 227620 254590
2 2 igmp 0 0 0 0 0 0 0
2 2 rtsock 0 3 0 0 0 36 36
2 2 arp 0 0 0 0 0 0 0
2 2 ether 0 0 529402 0 0 0 529402
2 2 ip6 0 1 0 0 0 2 2
2 2 ip_direct 0 0 0 0 0 0 0
2 2 ip6_direct 0 0 0 0 0 0 0
3 3 ip 0 24 0 5346 0 174797 180143
3 3 igmp 0 0 0 0 0 0 0
3 3 rtsock 0 0 0 0 0 0 0
3 3 arp 0 1 0 0 0 106 106
3 3 ether 0 0 26856 0 0 0 26856
3 3 ip6 0 0 0 16 0 0 16
3 3 ip_direct 0 0 0 0 0 0 0
3 3 ip6_direct 0 0 0 0 0 0 0
Quotein which you can move rules at any spot you wantThat sounds like more freedom but yet we will get less. :)