Date: Mon, 19 Mar 2007 15:12:52 -0500 From: David Gilbert <dgilbert@dclg.ca> To: Doug Barton <dougb@FreeBSD.org> Cc: freebsd-net@freebsd.org, Mark Andrews <Mark_Andrews@isc.org>, freebsd-rc@freebsd.org Subject: Re: rc.order wrong (ipfw) Message-ID: <17918.61124.353668.804988@canoe.dclg.ca> In-Reply-To: <45FE13E5.9060902@FreeBSD.org> References: <200703171210.l2HCAD63046801@drugs.dv.isc.org> <45FC7EAE.803@FreeBSD.org> <45FC90CE.3020605@gmail.com> <45FDD5C3.1070305@FreeBSD.org> <45FDF284.3040008@gmail.com> <45FE13E5.9060902@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
>>>>> "Doug" == Doug Barton <dougb@FreeBSD.org> writes: Doug> Kian Mohageri wrote: >> I agree VERY MUCH with this sort of approach. It would be a much >> cleaner solution than completely separate handling of all of these >> different problems. I'm trying to get an idea of what all of the >> major problems with the current order are, and these are the ones >> I'm aware of: >> >> - ipfw blocks by default (names unresolvable, rtsol breaks) - >> ipf/pf pass by default (services are unprotected) >> >> I think a firewall_boot script (similar to what you've proposed) >> could potentially solve all of these problems. Doug> exception, not the rule. Furthermore (and I'm betraying a Doug> prejudice here) I think that firewall rules that rely on name Doug> resolution are absolutely nuts, and I say that with many years Doug> of experience as a professional DNS and system administrator. I think you're misreading the above. The poster is saying that because ipfw's default behaviour is block, loading it at the wrong time can break other startup items because they require name resolution or the sending of packets (rtsol). Dave. -- ============================================================================ |David Gilbert, Independent Contractor. | Two things can be | |Mail: dave@daveg.ca | equal if and only if they | |http://daveg.ca | are precisely opposite. | =========================================================GLO================
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?17918.61124.353668.804988>