From owner-freebsd-pf@FreeBSD.ORG Thu Jul 17 15:11:55 2008 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id F37911065672 for ; Thu, 17 Jul 2008 15:11:54 +0000 (UTC) (envelope-from max@love2party.net) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.177]) by mx1.freebsd.org (Postfix) with ESMTP id 6E1B18FC12 for ; Thu, 17 Jul 2008 15:11:54 +0000 (UTC) (envelope-from max@love2party.net) Received: from vampire.homelinux.org (dslb-088-066-030-033.pools.arcor-ip.net [88.66.30.33]) by mrelayeu.kundenserver.de (node=mrelayeu0) with ESMTP (Nemesis) id 0MKwh2-1KJV970ihX-0000ec; Thu, 17 Jul 2008 17:11:53 +0200 Received: (qmail 35166 invoked from network); 17 Jul 2008 15:11:52 -0000 Received: from myhost.laiers.local (192.168.4.151) by ns1.laiers.local with SMTP; 17 Jul 2008 15:11:52 -0000 From: Max Laier Organization: FreeBSD To: freebsd-pf@freebsd.org Date: Thu, 17 Jul 2008 17:11:50 +0200 User-Agent: KMail/1.9.9 References: <48750381.1030004@eskk.nu> <4ad871310807170613y6d5df98dlf85f664399c9ca4c@mail.gmail.com> <20080717152849.0e90b307@twoflower.in.publishing.hu> In-Reply-To: <20080717152849.0e90b307@twoflower.in.publishing.hu> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200807171711.51208.max@love2party.net> X-Provags-ID: V01U2FsdGVkX1/YH+KHZWbRWnMluRsX+LvgvWBeYdWuVBMHze6 JboMD9VkB7UiPIutuVIX6hGgkplv1tdXGoXfY3t9veWinratH5 LFuLUVsfmEWC8zzbkj20g== Cc: Subject: Re: New pf install on Freebsd7 seem to be a slow starter. X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Jul 2008 15:11:55 -0000 On Thursday 17 July 2008 15:28:49 CZUCZY Gergely wrote: > On Thu, 17 Jul 2008 09:13:03 -0400 > > "Glen Barber" wrote: > > On Thu, Jul 17, 2008 at 9:00 AM, Glen Barber wrote: > > > I was under the assumption the OP runs his own DNS server, as that > > > is how my machine was set up. > > > > Another reason I thought about 'why' the OP used tables - aren't PF > > tables evaluated at boot, and macros evaluated when they are called? > > I think the latter negates the need for resolving at boot. Please > > correct me if I am wrong. > > Macros are evaluated at pfctl-time. That means, parse-time. Tables are > evaluated at runtime (that means, when a lookup is in progress). DNS lookups are always performed in userland at pfctl-time. It does not matter if you put your hostnames into a macro, table or rule directly - it will always be looked up by pfctl before even loading the rule/table into the kernel. If you really want to trust DNS lookups to influence your firewall rules (3 weeks till dooms day - is your resolver patched?!?) you should add an rc.d that depends on NETWORKING (or hook something up to ppp.linkup, or whereeverelse you can be sure that your resolver is working) and fill a predefined table from that script. i.e. "pfctl -t mytable -T add foo.bar.local" -- /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News