From owner-freebsd-questions Wed Jan 22 7:30:25 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9104637B401 for ; Wed, 22 Jan 2003 07:30:23 -0800 (PST) Received: from catflap.home.slightlystrange.org (pc1-cmbg1-4-cust43.cmbg.cable.ntl.com [62.253.133.43]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5578943EB2 for ; Wed, 22 Jan 2003 07:30:22 -0800 (PST) (envelope-from dan@slightlystrange.org) Received: from danielby by catflap.home.slightlystrange.org with local (Exim 3.36 #1) id 18bMpS-000LHG-00 for freebsd-questions@freebsd.org; Wed, 22 Jan 2003 15:30:14 +0000 Date: Wed, 22 Jan 2003 15:30:14 +0000 From: Daniel Bye To: freebsd-questions@freebsd.org Subject: Re: questions about static ipfw rules Message-ID: <20030122153013.GB80680@catflap.home.slightlystrange.org> Reply-To: dan@slightlystrange.org Mail-Followup-To: freebsd-questions@freebsd.org References: <20030122151833.GA80680@catflap.home.slightlystrange.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030122151833.GA80680@catflap.home.slightlystrange.org> User-Agent: Mutt/1.4i X-Scanner: exiscan *18bMpS-000LHG-00*K28MS3EaX1s* (SlightlyStrange.org, Using NOD32 http://www.nod32.com) Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Wed, Jan 22, 2003 at 03:18:33PM +0000, Daniel Bye wrote: > On Wed, Jan 22, 2003 at 09:45:09AM -0500, Stephen D. Kingrea wrote: > > running 4.7 with firewall, natd enabled kernel. i wish to create firewall > > rules outside of the rc.firewall script that remain static across > > reboots. to that end, i created a set (rc.firewall.rules), pointing > > rc.conf to that set: > > > > firewall_enable="YES" > > firewall_type="/etc/rc.firewall.rules" > > You should change "firewall_type" to "firewall_script". You should then > find all works as you want. Well, almost... If you do it this way, you need to make sure the script file is executable and makes sense as a shell script. I use something like #!/bin/sh IPFW=/sbin/ipfw ${IPFW} -f flush ${IPFW} add 100 allow ip from any to any via lo0 ... etc. It works well for me. Dan -- Daniel Bye PGP Key: ftp://ftp.slightlystrange.org/pgpkey/dan.asc PGP Key fingerprint: 3D73 AF47 D448 C5CA 88B4 0DCF 849C 1C33 3C48 2CDC _ ASCII ribbon campaign ( ) - against HTML, vCards and X - proprietary attachments in e-mail / \ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message