From 76c238741e845eec94973a4c280449c072fad93d Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 21:48:47 -0500 Subject: Clarify kldload pf is only needed for the dry-run check, not service start Verified on the VM: service pf start auto-loads the kernel module itself (required_modules="pf" in /etc/rc.d/pf, which rc.subr honors for start specifically) - service pf check and bare pfctl don't get the same treatment, so kldload is only necessary if you want to dry-run the ruleset before committing to it. The previous wording implied it was needed either way. Co-Authored-By: Claude Sonnet 5 --- README.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index 4244ab8..befa2e3 100644 --- a/README.md +++ b/README.md @@ -177,12 +177,18 @@ live on `$ext_if`), pf's dynamic-interface syntax can silently pick the wrong one and NAT jail traffic to the *private* address instead, which is just as unreachable from the internet as no NAT at all. -Check syntax before loading - `pfctl -nf` needs the kernel module loaded -even for a dry run - then enable it the normal way: +`sysrc pf_enable="YES"; service pf start` is enough on its own - the rc.d +script loads the kernel module itself, no manual `kldload` needed. Only +reach for `kldload pf` if you want to dry-run check the syntax with +`pfctl -nf` *before* committing to `start` - `pfctl` (unlike the rc.d +script) doesn't load the module for you, dry run or not: ``` # kldload pf # pfctl -nf /etc/pf.conf +``` + +``` # sysrc pf_enable="YES" # service pf start ``` -- cgit v1.3