rc.order wrong (ipfw)

[Kevin Oberman]

> Date: Fri, 16 Mar 2007 15:40:44 +0200
> From: Pertti Kosunen <pertti.kosunen at pp.nic.fi>
> Sender: owner-freebsd-stable at freebsd.org
> 
> JoaoBR wrote:
> > I don't agree to what you say
> > what sense does it make to have my forward rules up but natd still not?
> > what sense does it makes logging while syslog is not up?
> 
> What would it forward & log when network isn't up?

Hmm. Let's see. Maybe the stuff that happens between the start of the
network and the start of ipfw?

Remember that, by default, until ipfw starts, there is a default
65535 deny ip from any to any
in the firewall, thus blocking everything until ipfw starts.

You should either not build ipfw into the kernel or build with the
IPFIREWALL_DEFAULT_TO_ACCEPT option if you want something to be able to
pass through the network before ipfw starts. (Hint, if you run IPv6, you
probably do.)
-- 
R. Kevin Oberman, Network Engineer
Energy Sciences Network (ESnet)
Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)
E-mail: oberman at es.net			Phone: +1 510 486-8634
Key fingerprint:059B 2DDF 031C 9BA3 14A4  EADA 927D EBB3 987B 3751
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 224 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20070316/6addc818/attachment.pgp