<snip /etc/pf.conf> ext_if="fxp1" int_if="fxp0" pfsync_if="xl0" anchor pf_labels_tables load anchor pf_labels_tables from "/etc/pf_labels_tables.anchor" </snip>
# cat /etc/pf_labels_tables.anchor
table <site1_in> { 10.0.0.101 }
table <site2_in> { 10.0.0.102 }
table <site3_in> { 10.0.0.103 }
table <site4_in> { 10.0.0.104 }
table <site5_in> { 10.0.0.105 }
table <site1_out> { 192.168.0.31 }
table <site2_out> { 192.168.0.32 }
table <site3_out> { 192.168.0.33 }
table <site4_out> { 192.168.0.34 }
table <site5_out> { 192.168.0.35 }# pfctl -nf /etc/pf.conf
/etc/pf.conf:17: Rules must be in order: options, normalization, queueing, translation, filtering
/etc/pf.conf:18: Rules must be in order: options, normalization, queueing, translation, filtering
/etc/pf.conf:20: Rules must be in order: options, normalization, queueing, translation, filtering
/etc/pf.conf:22: Rules must be in order: options, normalization, queueing, translation, filtering
/etc/pf.conf:23: Rules must be in order: options, normalization, queueing, translation, filtering
/etc/pf.conf:24: Rules must be in order: options, normalization, queueing, translation, filtering
/etc/pf.conf:25: Rules must be in order: options, normalization, queueing, translation, filtering
/etc/pf.conf:26: Rules must be in order: options, normalization, queueing, translation, filtering
It appears that pfctl assumes that anchors only contain filter rules. Have I stumbled over a bug in either pf.conf (5) or pfctl, or am I doing/assuming something wrong?
Thanks,
-- Jason Dixon DixonGroup Consulting http://www.dixongroup.net
