diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2023-10-20 05:37:46 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2023-10-23 14:37:05 +0000 |
| commit | 4f33755051c60c6f65ba9f6aaa33d11e72909618 (patch) | |
| tree | 75dfdb742c09618e41ca47d3409b3e5378b40ce3 /sbin/pfctl | |
| parent | ef067b579954c3c443b2a70566e24d94a7583d19 (diff) | |
| download | src-4f33755051c60c6f65ba9f6aaa33d11e72909618.tar.gz src-4f33755051c60c6f65ba9f6aaa33d11e72909618.zip | |
Diffstat (limited to 'sbin/pfctl')
| -rw-r--r-- | sbin/pfctl/pfctl.8 | 13 | ||||
| -rw-r--r-- | sbin/pfctl/pfctl.c | 6 |
2 files changed, 15 insertions, 4 deletions
diff --git a/sbin/pfctl/pfctl.8 b/sbin/pfctl/pfctl.8 index 41eb2bea9f94..6c9a9f3b2ca4 100644 --- a/sbin/pfctl/pfctl.8 +++ b/sbin/pfctl/pfctl.8 @@ -24,7 +24,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd February 22, 2021 +.Dd October 20, 2023 .Dt PFCTL 8 .Os .Sh NAME @@ -43,7 +43,7 @@ .Op Fl K Ar host | network .Xo .Oo Fl k -.Ar host | network | label | id | gateway +.Ar host | network | label | id | gateway | nat .Oc Xc .Op Fl o Ar level .Op Fl p Ar device @@ -256,15 +256,16 @@ option may be specified, which will kill all the source tracking entries from the first host/network to the second. .It Xo .Fl k -.Ar host | network | label | id | gateway +.Ar host | network | label | id | gateway | nat .Xc Kill all of the state entries matching the specified .Ar host , .Ar network , .Ar label , .Ar id , +.Ar gateway, or -.Ar gateway. +.Ar nat. .Pp For example, to kill all of the state entries originating from .Dq host : @@ -332,6 +333,10 @@ To kill all states using a gateway in 192.168.0.0/24: .Pp .Dl # pfctl -k gateway -k 192.168.0.0/24 .Pp +States can also be killed based on their pre-NAT address: +.Pp +.Dl # pfctl -k nat -k 192.168.0.1 +.Pp .It Fl M Kill matching states in the opposite direction (on other interfaces) when killing states. diff --git a/sbin/pfctl/pfctl.c b/sbin/pfctl/pfctl.c index c3f3d82ff767..03b7f24ce60a 100644 --- a/sbin/pfctl/pfctl.c +++ b/sbin/pfctl/pfctl.c @@ -725,6 +725,12 @@ pfctl_net_kill_states(int dev, const char *iface, int opts) sizeof(kill.ifname)) >= sizeof(kill.ifname)) errx(1, "invalid interface: %s", iface); + if (state_killers == 2 && (strcmp(state_kill[0], "nat") == 0)) { + kill.nat = true; + state_kill[0] = state_kill[1]; + state_killers = 1; + } + pfctl_addrprefix(state_kill[0], &kill.src.addr.v.a.mask); if (opts & PF_OPT_KILLMATCH) |