From owner-freebsd-questions  Thu Mar  6 11:14:47 2003
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id AD0B937B401
	for <freebsd-questions@freebsd.org>; Thu,  6 Mar 2003 11:14:45 -0800 (PST)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 8C64B43FB1
	for <freebsd-questions@freebsd.org>; Thu,  6 Mar 2003 11:14:44 -0800 (PST)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Received: from cactus.fi.uba.ar (cactus.fi.uba.ar [157.92.49.108])
	by cactus.fi.uba.ar (8.12.3/8.12.3) with ESMTP id h26JDKDM072276;
	Thu, 6 Mar 2003 16:13:21 -0300 (ART)
	(envelope-from fgleiser@cactus.fi.uba.ar)
Date: Thu, 6 Mar 2003 16:13:20 -0300 (ART)
From: Fernando Gleiser <fgleiser@cactus.fi.uba.ar>
To: Josh Brooks <user@mail.econolodgetulsa.com>
Cc: freebsd-questions@freebsd.org
Subject: Re: loading ipfw module without default-deny
In-Reply-To: <20030306031748.W94847-100000@mail.econolodgetulsa.com>
Message-ID: <20030306161029.R65460-100000@cactus.fi.uba.ar>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Spam-Status: No, hits=-103.4 required=5.0
	tests=IN_REP_TO,USER_IN_WHITELIST
	version=2.31
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

On Thu, 6 Mar 2003, Josh Brooks wrote:

>
> Hello,
>
> I want to:
>
> kldload ipfw.ko
>
> but I am not near the physical machine, and cannot type in an allow rule
> after loading the module - by default all traffic will be denied.
>
> How can I load the ipfw.ko module but not knock myself off the network ?
>
> My only thought was to put an `ipfw add` rule into a cron job to run one
> minute after I load the module, but that seems silly :)


Try this:
# cd /sys/modules/ipfw
edit Makefile and uncomment the line:
#CFLAGS+= -DIPFIREWALL_DEFAULT_TO_ACCEPT
Then 'make; make install'


you may have to do a 'make clean' before is you already compiled the module.
After that, you'll have a ipfw.ko with a default accept policy.

Hope this helps


			Fer


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message