diff options
| -rw-r--r-- | README.md | 10 | ||||
| -rw-r--r-- | USER_GUIDE.md | 10 |
2 files changed, 16 insertions, 4 deletions
@@ -177,12 +177,18 @@ live on `$ext_if`), pf's dynamic-interface syntax can silently pick the wrong one and NAT jail traffic to the *private* address instead, which is just as unreachable from the internet as no NAT at all. -Check syntax before loading - `pfctl -nf` needs the kernel module loaded -even for a dry run - then enable it the normal way: +`sysrc pf_enable="YES"; service pf start` is enough on its own - the rc.d +script loads the kernel module itself, no manual `kldload` needed. Only +reach for `kldload pf` if you want to dry-run check the syntax with +`pfctl -nf` *before* committing to `start` - `pfctl` (unlike the rc.d +script) doesn't load the module for you, dry run or not: ``` # kldload pf # pfctl -nf /etc/pf.conf +``` + +``` # sysrc pf_enable="YES" # service pf start ``` diff --git a/USER_GUIDE.md b/USER_GUIDE.md index f5b446c..5bf517b 100644 --- a/USER_GUIDE.md +++ b/USER_GUIDE.md @@ -422,12 +422,18 @@ live on `$ext_if`), pf's dynamic-interface syntax can silently pick the wrong one and NAT jail traffic to the *private* address instead, which is just as unreachable from the internet as no NAT at all. -Check syntax before loading - `pfctl -nf` needs the kernel module loaded -even for a dry run - then enable it the normal way: +`sysrc pf_enable="YES"; service pf start` is enough on its own - the rc.d +script loads the kernel module itself, no manual `kldload` needed. Only +reach for `kldload pf` if you want to dry-run check the syntax with +`pfctl -nf` *before* committing to `start` - `pfctl` (unlike the rc.d +script) doesn't load the module for you, dry run or not: ``` # kldload pf # pfctl -nf /etc/pf.conf +``` + +``` # sysrc pf_enable="YES" # service pf start ``` |