pf on enc0 interface

[TERPLAK Alexandre <alex_(_at_)_vbone_(_dot_)_net>]

Hi,

Most people seem to allow any traffic through their ipsec tunnels using 
this kind of rules:

pass in quick on enc0 all
pass out quick on enc0 all

This works fine but I wanted to be more restrictive and have replaced 
the in rule with this one (have also tried other variants) :
pass in quick on enc0 proto icmp from any to any

For some reason it does not work. The incoming icmps are blocked by my 
default "block in all" rule. The same config however works with a tunnel 
that uses the ppp1 interface (or any other interface of course), so 
there must be something specific to enc0 ? Do you have any idea ? I know 
it's just a software loopback but it's usable to make pf rules right ?


Regards,
Alexandre