From owner-freebsd-stable  Sun Jan 27  9:51:48 2002
Delivered-To: freebsd-stable@freebsd.org
Received: from sage-american.com (sage-american.com [216.122.141.44])
	by hub.freebsd.org (Postfix) with ESMTP
	id 9DBD937B400; Sun, 27 Jan 2002 09:51:41 -0800 (PST)
Received: from SAGEONE (adsl-64-219-20-214.dsl.crchtx.swbell.net [64.219.20.214])
	by sage-american.com (8.9.3/8.9.3) with SMTP id LAA10973;
	Sun, 27 Jan 2002 11:51:37 -0600 (CST)
Message-Id: <3.0.5.32.20020127115133.01831ca0@mail.sage-american.com>
X-Sender: jacks@mail.sage-american.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Sun, 27 Jan 2002 11:51:33 -0600
To: "M. Warner Losh" <imp@village.org>
From: jacks@sage-american.com
Subject: Re: Firewall config non-intuitiveness
Cc: cjc@FreeBSD.ORG, nate@yogotech.com, stable@FreeBSD.ORG
In-Reply-To: <20020127.102748.70374201.imp@village.org>
References: <3.0.5.32.20020127075816.01831ca0@mail.sage-american.com>
 <20020127014848.F23259@blossom.cjclark.org>
 <20020127.052626.107682843.imp@village.org>
 <3.0.5.32.20020127075816.01831ca0@mail.sage-american.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-stable.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-stable>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-stable>
X-Loop: FreeBSD.ORG

The reason I mentioned leaving the FW rule loading out of the boot process,
I too have some things that at the moment cause problems loading some other
things with the rules in there. So after enough of that, I now start the FW
right after booting... of course hoping I don't forget to load the rules at
the moment bootup finishes.... BUT, of course I don't boot very often and
flush/reload the FW rules more often.... especially if I need to tweak a rule.

At 10:27 AM 1.27.2002 -0700, M. Warner Losh wrote:
>In message: <3.0.5.32.20020127075816.01831ca0@mail.sage-american.com>
>            jacks@sage-american.com writes:
>: What would be wrong with booting without loading a FW script and then
>: loading the rules after the boot is finished...???
>
>Right now what I have works.  You are changing the semantics of a
>security related feature of the system in such a way that after this
>change what I have will not work.  I agree that your work around will
>allow me to easily correct things.  However, if I fail to do so, I
>open my firewall up completely.  To me, that's an unacceptible change
>in the API.
>
>Warner
>
>

Best regards,
Jack L. Stone,
Server Admin

===================================================
Sage-American 
http://www.sage-american.com
jacks@sage-american.com

"My center is giving way, my right is in retreat;
....situation excellent! ....I shall attack!"
===================================================

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message