From owner-freebsd-pf@FreeBSD.ORG Sun Jul 16 22:56:39 2006 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B43F316A4DA; Sun, 16 Jul 2006 22:56:39 +0000 (UTC) (envelope-from Greg.Hennessy@nviz.net) Received: from smtp.nildram.co.uk (smtp.nildram.co.uk [195.112.4.54]) by mx1.FreeBSD.org (Postfix) with ESMTP id 01A6A43D5D; Sun, 16 Jul 2006 22:56:38 +0000 (GMT) (envelope-from Greg.Hennessy@nviz.net) Received: from gw2.local.net (unknown [62.3.210.251]) by smtp.nildram.co.uk (Postfix) with ESMTP id 29B282376B8; Sun, 16 Jul 2006 23:56:33 +0100 (BST) From: "Greg Hennessy" To: "'Daniel Hartmeier'" , =?iso-8859-1?Q?'Dag-Erling_Sm=F8rgrav'?= Date: Sun, 16 Jul 2006 23:56:35 +0100 Keywords: freebsd-pf Message-ID: <000c01c6a92b$167fcd00$0a00a8c0@thebeast> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 Thread-Index: AcapI1FTJviArYNETTy3a0qJjTWQMQABozmA In-Reply-To: <20060716214456.GE3240@insomnia.benzedrine.cx> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869 X-OriginalArrivalTime: 16 Jul 2006 22:56:35.0280 (UTC) FILETIME=[167FCD00:01C6A92B] Cc: freebsd-security@freebsd.org, freebsd-pf@freebsd.org Subject: RE: Any ongoing effort to port /etc/rc.d/pf_boot, /etc/pf.boot.conf from NetBSD ? X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Jul 2006 22:56:39 -0000 =20 > I'm not sure the average user _really_ is worried enough=20 > about that half a second period on boot. But I DO know there=20 > will be people locking themselves out from far-away remote=20 > hosts (on updates, for instance) if this becomes the default. That is pretty much guaranteed. Murphy will always find a way to f*ck up = a reboot and simultaneously cause the 2611 on the console port to halt and catch fire.=20 If punters want a default block, IMHO it doesn=92t get much easier than = using the mac_ifoff(4) kernel option discussed earlier on in the week, they = can tweak the pf startup to twiddle the relevant sysctl appropriately at the right moment in time.=20 In order to salve the consciences of those who know naught but tick = boxes, and more importantly make them STFU and annoy someone else.=20 Perhaps a codicil to the FreeBSD pf.conf manpage, detailing the = mac_ifoff approach as a wholly unsupported solution for 'default block' to satisfy = the anally retentive.=20 Greg