Date: Tue, 11 Apr 2017 22:37:54 +1000 (EST) From: Ian Smith <smithi@nimnet.asn.au> To: Polytropon <freebsd@edvax.de> Cc: Miha Smrekar <smrekar.miha@gmail.com>, freebsd-questions@freebsd.org Subject: Re: FreeBSD firewall configuration Message-ID: <20170411223428.O9330@sola.nimnet.asn.au> In-Reply-To: <20170411220239.S9330@sola.nimnet.asn.au> References: <mailman.81.1491912002.74192.freebsd-questions@freebsd.org> <20170411220239.S9330@sola.nimnet.asn.au>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 11 Apr 2017 22:25:03 +1000, Ian Smith wrote:
> In freebsd-questions Digest, Vol 671, Issue 2, Message: 3
> On Mon, 10 Apr 2017 21:37:47 +0200 Polytropon <freebsd@edvax.de> wrote:
>
> > > Can you also help me with the rule to forward incoming trafic to other
> > > interface?
> >
> > You first need to put
> >
> > net.inet.ip.forwarding=1
> >
> > into /etc/sysctl.conf and make this change active (read: reboot or
>
> Reboot? Like Windows? :)
>
> > manually call "service sysctl restart".
> >
> > Additionally, add
> >
> > gateway_enable="YES"
> >
> > to /etc/rc.conf.
>
> Just a minor niggle .. having gateway_enable="YES" in rc.conf causes
> net.inet.ip.forwarding=1 to be set by /etc/rc.d/routing, so you don't
> need to add it to /etc/sysctl.conf as well - though it won't hurt,
> unless you later wanted to turn it off by updating rc.conf :)
Actually, on a further check that I should have done before posting:
smithi@x200:~ % rcorder /etc/rc.d/* | egrep 'sysctl|routing'
/etc/rc.d/sysctl
/etc/rc.d/routing
So the rc.conf setting will override sysctl.conf anyway. Still ..
> Then just a 'service routing restart' will do the trick. From which:
>
> if checkyesno gateway_enable; then
> ropts_init inet
> echo -n ' gateway=YES'
> ${SYSCTL} net.inet.ip.forwarding=1 > /dev/null
> else
> ${SYSCTL} net.inet.ip.forwarding=0 > /dev/null
> fi
>
> cheers, Ian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20170411223428.O9330>