Date: Wed, 21 Feb 2007 11:15:51 -0800 From: "Kevin Oberman" <oberman@es.net> To: "Scot Hetzel" <swhetzel@gmail.com> Cc: current@freebsd.org, Eric Anderson <anderson@freebsd.org> Subject: Re: Unable to use network early in boot with recent -current Message-ID: <20070221191551.19A9745053@ptavv.es.net> In-Reply-To: Your message of "Wed, 21 Feb 2007 12:31:05 CST." <790a9fff0702211031r226ba0bdsfab2eab5f4748191@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--==_Exmh_1172085351_67328P Content-Type: text/plain; charset=us-ascii Content-Disposition: inline > Date: Wed, 21 Feb 2007 12:31:05 -0600 > From: "Scot Hetzel" <swhetzel@gmail.com> > > On 2/21/07, Kevin Oberman <oberman@es.net> wrote: > > > Firewall rules? > > > > Please ignore my prior message. I just tried and "ipfw list" shows the > > single default deny rule, "65535 deny ip from any to any". I have no > > idea why this is in effect at this early in the startup process...long > > before the firewall rules are loaded. Guess I will stop loading ipfw at > > boot time and let the startup file load it. > > > That is the default ipfw deny rule when ipfw is loaded, it is used to > protect the system from intrusion by unauthorized persons, until you > have your firewall rules loaded. > > You can add: > > option IPFIREWALL_DEFAULT_TO_ACCEPT > > to your kernel config file, which would open your system to the world > until your firewall rules restrict what other systems can access on > that server. Thanks, Scot. I figured that out. I was confused by the change in behavior until I remembered that I used to load ipfw.ko from the ipfw startup script and, to fix the annoying problem of the wrong version of .ko being loaded when I am running a non-default kernel, I added it to /boot/loader.conf. Now ipfw is running from the moment the system boots. I have worked around this with a modification to profile.sh to insert a rule at the beginning and delete it before exiting. Seems to work. Thanks again to both you and Eric for pointing out my brain dead condition. Any thought of making module loads default to the directory of the booted kernel (e.g. /boot/kernel.old) instead of /boot/kernel? -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman@es.net Phone: +1 510 486-8634 Key fingerprint:059B 2DDF 031C 9BA3 14A4 EADA 927D EBB3 987B 3751 --==_Exmh_1172085351_67328P Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: Exmh version 2.5 06/03/2002 iD8DBQFF3Jpnkn3rs5h7N1ERAqfcAJ9U2p4ru35lUjIclb9GYT6m2Q2xOACeNxRM OSZ++BaVh/qCTmsiTn53FGI= =w9fO -----END PGP SIGNATURE----- --==_Exmh_1172085351_67328P--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070221191551.19A9745053>