SMP and networking under FreeBSD 5.3

[Alex Zbyslaw]

Joe wrote:

>Hey thanks, 
>
>   it seems that ipfw complains during boot with a message:
>
>hostname ``or'' unknown
>
>   which I have no idea where that is coming from yet, but will
>look.  
>
>   Then natd doesn't get started.  
>
>   If I run /etc/rc.d/ipfw start then the router is up and natd
>gets started.    
>
>   For now, I'll probably just add it to rc at the end.  I think
>it has something to do with the order things get run.  
>
>   My firewall script is for a dhcp interface.  Since I don't
>know the IP, I use ifconfig dc0 | grep -v inet6 | grep inet |
>awk ... to get the IP address for some of the rules.  I'm
>wondering if this is failing and causing the message above.
>
>   Is there a 'recommended' way to create a rule for ipfw on a
>dhcp interface  using its IP address?  
>
>  
>
You don't need any of your awk/grep palaver.  Your ipfw rules should 
probably be specifying the interface not ip addresses.  Natd with 
-dynamic will do the right thing when dhcp picks up its actual ip address.

from man natd

     -dynamic    If the -n or -interface option is used, natd will 
monitor the
                 routing socket for alterations to the interface passed.  If
                 the interface's IP address is changed, natd will 
dynamically
                 alter its concept of the alias address.

I have, for example:

/etc/rc.conf:

    ifconfig_sis0="DHCP"                            # External network

/etc/rc.firewall script

    ipfw add divert natd all from any to any via sis0

and it all works just fine even though natd starts off saying that it 
sees an IP address of 0.0.0.0

Your error message is very likely down to your "ifconfig | stuff" 
command which may well run when there is no ip address configured.  
It'll work fine when you run it once the ip address is configured, but 
probably not before when the script actually runs.

Why do you think your firewall rules need to know the IP address?  If 
you do need it then ipfw2 (5.X only?) has "me".  From man ipfw

     me     matches any IP address configured on an interface in the system.
             The address list is evaluated at the time the packet is 
analyzed.

If you have that after your natd rule, though, it will (I think) just 
match everything so the interface name is good enough.  e.g. from any to 
any via sis0

--Alex