"pflog0: permanently promiscuous mode enabled", safe/normal?

[NoncarbonatedClack]

I'm coming back to opnsense after not being able to run it for a while, I noticed this entry during boot that I hadn't seen before:

Configuring firewall.... pflog0: permanently promiscuous mode enabled
done.

Checking via cli, and knowing that my WAN interface is VMX0, if I run configctl interface show bpf, I see:
"interface-name":"pflog0","promiscuous":true.

I could see promiscuous mode being a requirement on the inside interface, for VLANs/IDS/IPS or something, but it appears to be on the outside interface only.

I'm just wondering if that's normal, is promiscuous mode a requirement of the pf? Want to make sure before I put this in prod.

Running OPNsense 23.1.11-amd64 in a VM.

Thanks!

[franco]

Hi,

pflog is the device where the packet filter sends packages that have been flagged as log in the matching firewall rule. But since the device has no address the promiscuous mode required to read all the packets added there.

We previously only used promiscuous mode in the filterlog utility having to set it each time it was opened but nowadays we set "permanent" promiscuous mode on the device which stops the kernel from producing the disabled/enabled messages when the rules are being reloaded.


Cheers,
Franco

[NoncarbonatedClack]

Hi Franco,

Thank you for clearing that up! I appreciate it.
Opnsense is in prod on my home network now again.