PF starts before interface, how to solve?

Question

FreeBSD

Hello.
There is an OpenVPN server on FreeBSD protected by PF. There is a rule regarding the tun0 interface of the OpenVPN server. The catch is that PF loads before OpenVPN, does not see the tun0 interface, and therefore does not apply the rules, because, in its opinion, there is an error in the rules file.
Is there an elegant way to solve this problem? You can, of course, run the packet filter last, but you don’t really want to.

Answer 1

Figured it out myself. Where PF converts an interface name to its IP address, it needs to parenthesize the construct so that it treats it as dynamic. In my case, there was an interface network, inside the rule it looks like this:
Rules where the interface itself appears, and not its address, are ignored by PF, even if such an interface does not exist.