[nycbug-talk] PF question: Can I make a const table made up of lists

[Max Gribov]

Mark Saad wrote:
> Hello All
>    Here is my question; when using PF  can I create a const table made 
> up of predefined lists.
>   

table <somename> persist file "/etc/sometable"

sometable file would have one ip per line..



> Here is my example it does not work I am using FreeBSD 7.1-RELEASE i386 .
>
> =============================
>
> ext_if="bge0"
> int_if="bge1"
>
> #My Netgroup lists
> NETGROUP_SJL  = "{ 10.70.123.218 10.70.123.112/28 10.70.118.192/26 
> 10.131.146.132 }"
> NETGROUP_LON  = "{ 10.72.241.218 10.72.241.192/28 10.72.241.32/27 }"
> NETGROUP_EWR  = "{ 10.27.64.218 10.106.131.0/24 10.27.64.212/30 }"
> NETGROUP_HKG  = "{ 10.168.209.218 10.168.209.40 10.168.208.100 
> 10.168.209.192/28 }"
> NETGROUP_BACKUP = "{ 192.168.12.0/26 }"
> ISILON_SMQ = "{ 192.168.14.0/24 }"
>
> table NETGROUP_ALL const { $NETGROUP_SJL $NETGROUP_LON $NETGROUP_EWR 
> $NETGROUP_HKG $NETGROUP_BACKUP }
>
> # Do not filter lo
> set skip on {lo0}
>
> # Normalize
> scrub in
>
> # NAT the internal network to the outside world
> nat on $ext_if from !($ext_if) to any -> ($ext_if)
>
> # Begin Firewall rules
> block in
> pass out
>
> pass quick on $int_if no state
> antispoof quick for { lo $int_if }
>
> pass in quick on $ext_if inet proto tcp from NETGROUP_ALL to ($ext_if) 
> port 22
>
> ===============================
>
>
> The issue is when I test out the rules with pfctl -vnf /etc/pf.conf I 
> get the following error
>
> /etc/pf.conf:15: syntax error
> set skip on { lo0 }
> no IP address found for NETGROUP_ALL
> /etc/pf.conf:33: could not parse host specification
> %
>
> Any ideas ?
>
>