From owner-freebsd-questions@FreeBSD.ORG Wed Apr 23 13:01:42 2003 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 993F337B401 for ; Wed, 23 Apr 2003 13:01:42 -0700 (PDT) Received: from rs2.rapidaxcess.com (rs2.rapidaxcess.com [207.173.183.243]) by mx1.FreeBSD.org (Postfix) with ESMTP id 06DDD43FBF for ; Wed, 23 Apr 2003 13:01:42 -0700 (PDT) (envelope-from felix@rapidaxcess.com) Received: from Bernie (0-1pool183-98.nas20.tempe1.az.us.da.qwest.net [67.3.183.98]) by rs2.rapidaxcess.com (8.9.1/8.9.1) with SMTP id NAA00518; Wed, 23 Apr 2003 13:58:08 -0700 (MST) Date: Wed, 23 Apr 2003 13:58:08 -0700 (MST) Message-Id: <200304232058.NAA00518@rs2.rapidaxcess.com> X-Sender: felix@rapidaxcess.com X-Mailer: Windows Eudora Pro Version 2.1.2 Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" To: Josh Paetzel From: felix@rapidaxcess.com cc: questions@FreeBSD.org Subject: Re: Firewall options X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Apr 2003 20:01:42 -0000 Thanks guys. The fix was to 'make clean' and start over. At 01:39 PM 4/23/03 -0500, you wrote: >On Wed, Apr 23, 2003 at 12:29:46PM -0700, felix@rapidaxcess.com wrote: >> To whom it may concern: >> I am in the process of setting up my first firewalled machine, on the bench >> thank God. >> I have poured over the manual pages multiple times and am stuck here... >> >> I seem to have everything under control with rules set up to allow me in on >> boot. Now I need to change the default rule (65535) to deny instead of accept. >> I have removed the kernel config line: options IPFIREWALL_DEFAULT_TO_ACCEPT >> recompiled and rebooted 2 times, still the default is accept. >> I hate to hack by adding a rule 65000 to deny just for a work around, if >> that would even work... >> Suggestions? >> >> Thanks in advance! And keep up the great work, all of my servers run FreeBSD! >> >> Bryan Felix >> felix@rapidaxcess.com >> > >Well, adding that rule would work, but it would be a hack. Are you SURE you >are booting the kernel you think you are? Try renaming the kernel with the >IPFIREWALL_DEFAULT_TO_ALLOW option removed to a different name and see if >that's the kernel you're actually booting after the rebuild process. I've >seen two different 5.0 boxes in particular not boot the correct kernel after a >rebuild in the last two weeks. > >Josh > > >