SMP and networking under FreeBSD 5.3

[Joe]

Actually it is not my divert rule that I am using the ip
address. In fact my rc.conf has the 'right stuff' for natd, as
the same ipfw rules worked in 5.2 and 5.1.  Same rc.conf stuff
for natd too.

The ifconfig stuff is for other rules like:

ipfw add allow tcp from $EXT_IPADDR to any out xmit dc0 setup
keep-state

I use ifconfig stuff to get EXT_IPADDR for the above rule.  I
suppose I could use 'me' as I usually am referring to both
interfaces.   I'll probably change to use me and see how that
goes. 

I'm not sure why I get the hostname ``or'' unknown message
though.

Joe

--- Alex Zbyslaw <xfb52 at dial.pipex.com> wrote:

> Joe wrote:
> 
> >Hey thanks, 
> >
> >   it seems that ipfw complains during boot with a message:
> >
> >hostname ``or'' unknown
> >
> >   which I have no idea where that is coming from yet, but
> will
> >look.  
> >
> >   Then natd doesn't get started.  
> >
> >   If I run /etc/rc.d/ipfw start then the router is up and
> natd
> >gets started.    
> >
> >   For now, I'll probably just add it to rc at the end.  I
> think
> >it has something to do with the order things get run.  
> >
> >   My firewall script is for a dhcp interface.  Since I don't
> >know the IP, I use ifconfig dc0 | grep -v inet6 | grep inet |
> >awk ... to get the IP address for some of the rules.  I'm
> >wondering if this is failing and causing the message above.
> >
> >   Is there a 'recommended' way to create a rule for ipfw on
> a
> >dhcp interface  using its IP address?  
> >
> >  
> >
> You don't need any of your awk/grep palaver.  Your ipfw rules
> should 
> probably be specifying the interface not ip addresses.  Natd
> with 
> -dynamic will do the right thing when dhcp picks up its actual
> ip address.
> 
> from man natd
> 
>      -dynamic    If the -n or -interface option is used, natd
> will 
> monitor the
>                  routing socket for alterations to the
> interface passed.  If
>                  the interface's IP address is changed, natd
> will 
> dynamically
>                  alter its concept of the alias address.
> 
> I have, for example:
> 
> /etc/rc.conf:
> 
>     ifconfig_sis0="DHCP"                            # External
> network
> 
> /etc/rc.firewall script
> 
>     ipfw add divert natd all from any to any via sis0
> 
> and it all works just fine even though natd starts off saying
> that it 
> sees an IP address of 0.0.0.0
> 
> Your error message is very likely down to your "ifconfig |
> stuff" 
> command which may well run when there is no ip address
> configured.  
> It'll work fine when you run it once the ip address is
> configured, but 
> probably not before when the script actually runs.
> 
> Why do you think your firewall rules need to know the IP
> address?  If 
> you do need it then ipfw2 (5.X only?) has "me".  From man ipfw
> 
>      me     matches any IP address configured on an interface
> in the system.
>              The address list is evaluated at the time the
> packet is 
> analyzed.
> 
> If you have that after your natd rule, though, it will (I
> think) just 
> match everything so the interface name is good enough.  e.g.
> from any to 
> any via sis0
> 
> --Alex
> 



		
__________________________________ 
Discover Yahoo! 
Get on-the-go sports scores, stock quotes, news and more. Check it out! 
http://discover.yahoo.com/mobile.html