From owner-freebsd-pf@FreeBSD.ORG Fri Mar 25 00:23:18 2005 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AE83916A4CE for ; Fri, 25 Mar 2005 00:23:18 +0000 (GMT) Received: from moutng.kundenserver.de (moutng.kundenserver.de [212.227.126.176]) by mx1.FreeBSD.org (Postfix) with ESMTP id C436443D55 for ; Fri, 25 Mar 2005 00:23:17 +0000 (GMT) (envelope-from max@love2party.net) Received: from [212.227.126.179] (helo=mrelayng.kundenserver.de) by moutng.kundenserver.de with esmtp (Exim 3.35 #1) id 1DEcbd-0005yt-00; Fri, 25 Mar 2005 01:23:17 +0100 Received: from [84.128.142.116] (helo=donor.laier.local) by mrelayng.kundenserver.de with asmtp (TLSv1:RC4-MD5:128) (Exim 3.35 #1) id 1DEcbc-0006Jt-00; Fri, 25 Mar 2005 01:23:17 +0100 From: Max Laier To: freebsd-pf@freebsd.org, jon@abccomm.com Date: Fri, 25 Mar 2005 01:22:53 +0100 User-Agent: KMail/1.7.2 References: <787dcac20503241448430a7de2@mail.gmail.com> <8eea04080503241516211d5aea@mail.gmail.com> In-Reply-To: <8eea04080503241516211d5aea@mail.gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="nextPart2524232.sBkiDuRPJc"; protocol="application/pgp-signature"; micalg=pgp-sha1 Content-Transfer-Encoding: 7bit Message-Id: <200503250123.01060.max@love2party.net> X-Provags-ID: kundenserver.de abuse@kundenserver.de auth:61c499deaeeba3ba5be80f48ecc83056 Subject: Re: Isn't there a way to parse, don't load rules and complain about syntax errors or missing variables ? X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical discussion and general questions about packet filter (pf) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Mar 2005 00:23:18 -0000 --nextPart2524232.sBkiDuRPJc Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Friday 25 March 2005 00:16, Jon Simola wrote: > On Thu, 24 Mar 2005 16:48:48 -0600, BB wrote: > > However when I looked at the configuration file again the scrub rule > > had the explicate interface name fxp0 > > > > This new box doesn't have fxp0 > > It will probably make sense if you think that some interfaces like > vlan and tun are created and destroyed. You probably don't want to > reload your firewall config everytime you bring up a PPP link. That's part of the reasoning. Also you usually want to have rules to block= =20 PPP traffic *before* you bring up the link etc. ... in the end it's=20 hard^Wimpossible to satisfy everybody. As for "detecting" this kind of=20 foot-shooting, you can do a "$pfctl -vsI | grep placeholder" after you load= ed=20 the ruleset. Something that should probably go to a TBD "Debugging PF - be= st=20 pratices" article in our doc tree. Any takers :-) > ipfw has the same feature. Not quite. IPFW just does pattern matching on the interface name, somethin= g=20 that is even more nasty and can be a lot of fun when you have vlan1 and=20 vlan11. But that just as a sidenote. =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart2524232.sBkiDuRPJc Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQBCQ1nkXyyEoT62BG0RArFSAJ4xCSLncAgpN8mwbdz/p+b/i0JatACdFcF2 cfyfuFi620+NwJ6gWe3zqKA= =1Vre -----END PGP SIGNATURE----- --nextPart2524232.sBkiDuRPJc--