From owner-freebsd-questions@FreeBSD.ORG Fri Feb 27 12:43:18 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 43AD616A4CE for ; Fri, 27 Feb 2004 12:43:18 -0800 (PST) Received: from spock.ste-land.com (spock.ste-land.com [64.32.179.40]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0E9EA43D31 for ; Fri, 27 Feb 2004 12:43:18 -0800 (PST) (envelope-from ste@ste-land.com) Received: from ste-land.com (bgp377940bgs.plnfld01.nj.comcast.net [68.36.5.198]) by spock.ste-land.com (Postfix) with ESMTP id 2969C2D24C; Fri, 27 Feb 2004 15:43:17 -0500 (EST) Message-ID: <403FABE4.6050608@ste-land.com> Date: Fri, 27 Feb 2004 15:43:16 -0500 From: "Shaun T. Erickson" User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4b) Gecko/20030507 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Warren Block References: <20040227194414.835572B4DA7@mail.evilcoder.org> <403F9F4B.6080608@ste-land.com> <20040227132231.P2868@wonkity.com> In-Reply-To: <20040227132231.P2868@wonkity.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-questions@freebsd.org Subject: Re: Firewall enabling confusion. X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Feb 2004 20:43:18 -0000 Warren Block wrote: > On Fri, 27 Feb 2004, Shaun T. Erickson wrote: > > >>Thanks! Yes, the ipfw.ko module is getting loaded. So now I just need to >>know how to enable things like divert and logging. > > > /etc/rc.firewall has examples. I looked at that. That's not what I mean. :) I mean, if I do not have to build a new kernel to enable firewalling, logging and divert, then how do I enable them, such that the following line from my messages file would show that they have been enabled? Adding firewall_enable="YES" to rc.conf caused the ipfw module to be loaded, enabling firewalling. Adding firewall_logging="YES" did *not* enable logging in the message file line shown below. How do I do that? How would I get that line to show divert as being enabled? I may be wrong (correct me if I am, please), but doesn't that line have to show them as enabled, before I can successfully make use of them in ipfw commands like those you pointed me to in rc.firewall? What if I want that line to report that the default is open, instead of deny? Feb 27 14:37:22 peter kernel: ipfw2 initialized, divert disabled, rule-based forwarding enabled, default to deny, logging disabled -ste