From owner-freebsd-stable Mon Jan 28 13: 1:39 2002 Delivered-To: freebsd-stable@freebsd.org Received: from gw.nectar.cc (gw.nectar.cc [208.42.49.153]) by hub.freebsd.org (Postfix) with ESMTP id DD88C37B402 for ; Mon, 28 Jan 2002 13:01:28 -0800 (PST) Received: from madman.nectar.cc (madman.nectar.cc [10.0.1.111]) by gw.nectar.cc (Postfix) with ESMTP id 743304C for ; Mon, 28 Jan 2002 15:01:28 -0600 (CST) Received: (from nectar@localhost) by madman.nectar.cc (8.11.6/8.11.6) id g0SL1SS43269 for freebsd-stable@FreeBSD.ORG; Mon, 28 Jan 2002 15:01:28 -0600 (CST) (envelope-from nectar) Date: Mon, 28 Jan 2002 15:01:28 -0600 From: "Jacques A. Vidrine" To: freebsd-stable@FreeBSD.ORG Subject: Re: firewall config (CTFM) Message-ID: <20020128210128.GG42996@madman.nectar.cc> Mail-Followup-To: "Jacques A. Vidrine" , freebsd-stable@FreeBSD.ORG References: <20020128113806.O95859-100000@rockstar.stealthgeeks.net> <20020128132015.A66369@colnta.acns.ab.ca> <20020128203640.GB42996@madman.nectar.cc> <20020128134717.F66369@colnta.acns.ab.ca> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20020128134717.F66369@colnta.acns.ab.ca> User-Agent: Mutt/1.3.27i X-Url: http://www.nectar.cc/ Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Mon, Jan 28, 2002 at 01:47:17PM -0700, Chad David wrote: > On Mon, Jan 28, 2002 at 02:36:40PM -0600, Jacques A. Vidrine wrote: > > On Mon, Jan 28, 2002 at 01:20:15PM -0700, Chad David wrote: > > > One of the things I would recommend documenting very clearly is that > > > you DO NOT NEED TO COMPILE IPFW INTO THE KERNEL. > > > > Except if you want to default to deny, you must [1]. The rc system > > loads the firewall after configuring your interfaces. This may be a > > bug. > > Hmmm, possibly. But given that this is exactly the behavior that is > being argued for I'm not sure I'd call it a bug. I'm not sure you understood what I meant (I should have written `firewall module' rather than `firewall' above). It could be called a bug for network interfaces to be activated before the network security policy has been set. > If you want rc.conf > to be able to disable or enable the actual firewall code then this is > something that you have to live with, unless it defaults to deny and when > == "NO" is found it disables it, but the if you for some reason make a > mistake you are locked out (which I like), and that was at least one of > the problems people have had with the current way things work. I'm sorry, I don't follow you. Cheers, -- Jacques A. Vidrine http://www.nectar.cc/ NTT/Verio SME . FreeBSD UNIX . Heimdal Kerberos jvidrine@verio.net . nectar@FreeBSD.org . nectar@kth.se To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message