diff options
| author | Claude <noreply@anthropic.com> | 2026-09-02 21:48:47 -0500 |
|---|---|---|
| committer | Claude <noreply@anthropic.com> | 2026-09-02 21:48:47 -0500 |
| commit | 76c238741e845eec94973a4c280449c072fad93d (patch) | |
| tree | 660ec819786d65cf1a2403e44f4f7cd2dd7082fc | |
| parent | 48d4c516c81dc3c1394ebea5ecd5aa588bc6960a (diff) | |
Clarify kldload pf is only needed for the dry-run check, not service start
Verified on the VM: service pf start auto-loads the kernel module itself
(required_modules="pf" in /etc/rc.d/pf, which rc.subr honors for start
specifically) - service pf check and bare pfctl don't get the same
treatment, so kldload is only necessary if you want to dry-run the
ruleset before committing to it. The previous wording implied it was
needed either way.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
| -rw-r--r-- | README.md | 10 | ||||
| -rw-r--r-- | USER_GUIDE.md | 10 |
2 files changed, 16 insertions, 4 deletions
@@ -177,12 +177,18 @@ live on `$ext_if`), pf's dynamic-interface syntax can silently pick the wrong one and NAT jail traffic to the *private* address instead, which is just as unreachable from the internet as no NAT at all. -Check syntax before loading - `pfctl -nf` needs the kernel module loaded -even for a dry run - then enable it the normal way: +`sysrc pf_enable="YES"; service pf start` is enough on its own - the rc.d +script loads the kernel module itself, no manual `kldload` needed. Only +reach for `kldload pf` if you want to dry-run check the syntax with +`pfctl -nf` *before* committing to `start` - `pfctl` (unlike the rc.d +script) doesn't load the module for you, dry run or not: ``` # kldload pf # pfctl -nf /etc/pf.conf +``` + +``` # sysrc pf_enable="YES" # service pf start ``` diff --git a/USER_GUIDE.md b/USER_GUIDE.md index f5b446c..5bf517b 100644 --- a/USER_GUIDE.md +++ b/USER_GUIDE.md @@ -422,12 +422,18 @@ live on `$ext_if`), pf's dynamic-interface syntax can silently pick the wrong one and NAT jail traffic to the *private* address instead, which is just as unreachable from the internet as no NAT at all. -Check syntax before loading - `pfctl -nf` needs the kernel module loaded -even for a dry run - then enable it the normal way: +`sysrc pf_enable="YES"; service pf start` is enough on its own - the rc.d +script loads the kernel module itself, no manual `kldload` needed. Only +reach for `kldload pf` if you want to dry-run check the syntax with +`pfctl -nf` *before* committing to `start` - `pfctl` (unlike the rc.d +script) doesn't load the module for you, dry run or not: ``` # kldload pf # pfctl -nf /etc/pf.conf +``` + +``` # sysrc pf_enable="YES" # service pf start ``` |