diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 10 |
1 files changed, 8 insertions, 2 deletions
@@ -177,12 +177,18 @@ live on `$ext_if`), pf's dynamic-interface syntax can silently pick the wrong one and NAT jail traffic to the *private* address instead, which is just as unreachable from the internet as no NAT at all. -Check syntax before loading - `pfctl -nf` needs the kernel module loaded -even for a dry run - then enable it the normal way: +`sysrc pf_enable="YES"; service pf start` is enough on its own - the rc.d +script loads the kernel module itself, no manual `kldload` needed. Only +reach for `kldload pf` if you want to dry-run check the syntax with +`pfctl -nf` *before* committing to `start` - `pfctl` (unlike the rc.d +script) doesn't load the module for you, dry run or not: ``` # kldload pf # pfctl -nf /etc/pf.conf +``` + +``` # sysrc pf_enable="YES" # service pf start ``` |