[vbox] Failure on Mac 10.8.4: pf rules must be in order

[Mike Scherbakov]

Running latest version of vbox scripts from fuel-main repo (Mac 10.8.4):

Verifying interface vboxnet3 has IP 172.16.1.1 and mask 255.255.255.0 properly set.
OK.
To configure NAT and Firewall, the script requires the sudo password
Password:

Setting up masquerading configuration...
No ALTQ support in kernel
ALTQ related functions disabled
/etc/pf.conf:25: Rules must be in order: options, normalization, queueing, translation, filtering
pfctl: Syntax error in config file: pf rules not loaded

[Serhii Ovsianikov (sovsianikov)]

Mike, could you please provide us your /etc/pf.conf

[Mike Scherbakov (mihgen)]

My pf.conf:
scrub-anchor "com.apple/*"
nat-anchor "com.apple/*"
rdr-anchor "com.apple/*"
dummynet-anchor "com.apple/*"
anchor "com.apple/*"
load anchor "com.apple" from "/etc/pf.anchors/com.apple"
nat on en0 inet from ! (en0) to any -> (en0)
pass in on vboxnet0
pass in on vboxnet1
pass in on vboxnet2
pass in on vboxnet3

[Serhii Ovsianikov (sovsianikov)]

Mike, could you please clarify which option you have selected: yes or no?

If you have selected option ”no" then please remove following rules of of /etc/pf.conf:
nat on en0 inet from ! (en0) to any -> (en0)
pass in on vboxnet0
pass in on vboxnet1
pass in on vboxnet2
pass in on vboxnet3
then please execute this script again (launch.sh) and select option: "yes"

The following rule "nat on en0 inet from ! (en0) to any -> (en0)" should be added after the rule "dummynet-anchor "com.apple/*"". The other rules "pass in on vboxnet*" should be added to the end, after all rules.

In case, if /etс/pf.conf includes default rules, the script automatically does everything.

I’m going to update the list of rules to avoid misunderstanding in future.

[Mike Scherbakov (mihgen)]

We need to revert commit introducing pf-manipulations, and close this bug as Invalid after that.

[Mike Scherbakov (mihgen)]

Closed as issue was fixed by using other implementation: https://review.openstack.org/#/c/119717/