rc.order wrong (ipfw)
dougb at FreeBSD.org
Mon Mar 19 17:03:50 UTC 2007
Kian Mohageri wrote:
> After re-reading your original idea, I think I understand a little
> better what you mean to do. For clarification, are you proposing that
> the [early] firewall scripts do nothing if firewall_late_enable=YES, and
> then have all firewalling taken care of later in the boot process (i.e.
> post-networking) by firewall_late?
> I think I might have misunderstood your original proposal:)
I think so too. :) To be clear, what I'm suggesting is that we move
ipfw and pf to a spot in the rcorder that is ahead of netif, along
with ipfilter which is already there. I am not suggesting that we
change their functionality, just the ordering. As a completely
separate thing (although they could be done at the same time) I am
suggesting _adding_ a new script for "late" firewall rules (where
"late" is defined as after netif) so that people who want to do
firewall-related things that require netif (like cloned interfaces,
FQDN rules, etc.) will have a standard way to accomplish that.
Thanks for the opportunity to clarify,
This .signature sanitized for your protection
More information about the freebsd-net