From owner-freebsd-pf@FreeBSD.ORG  Thu Jul 10 13:01:34 2008
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 67A84106566B
	for <freebsd-pf@freebsd.org>; Thu, 10 Jul 2008 13:01:34 +0000 (UTC)
	(envelope-from hideous@mail.ru)
Received: from eta.smtp.skif.com.ua (eta.smtp.skif.com.ua [91.90.18.1])
	by mx1.freebsd.org (Postfix) with ESMTP id 2A8C38FC0C
	for <freebsd-pf@freebsd.org>; Thu, 10 Jul 2008 13:01:33 +0000 (UTC)
	(envelope-from hideous@mail.ru)
Received: from den.unicom (shota20b-unicom.skif.com.ua [91.90.21.238])
	by smtp.skif.com.ua (Postfix) with ESMTP id 5B4FE3F7B9;
	Thu, 10 Jul 2008 16:03:48 +0300 (EEST)
Date: Thu, 10 Jul 2008 16:01:32 +0300
From: Dennis <hideous@mail.ru>
X-Priority: 3 (Normal)
Message-ID: <101002322.20080710160132@mail.ru>
To: Leslie Jensen <leslie@eskk.nu>
In-Reply-To: <4875FF7D.8050304@eskk.nu>
References: <48750381.1030004@eskk.nu> <20080709225423.GB1011@verio.net>
	<4875D33C.2010506@eskk.nu> <3910389261.20080710125542@mail.ru>
	<4875FD52.1090201@eskk.nu> <4875FF7D.8050304@eskk.nu>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Cc: freebsd-pf@freebsd.org
Subject: Re[2]: New pf install on Freebsd7 seem to be a slow starter.
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: "Nobody A. Unknown" <hideous@mail.ru>
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Jul 2008 13:01:34 -0000

LJ> Leslie Jensen skrev:
>> 
>> Dennis skrev:
>> 
>>> LJ> Oh, I didn't know that! Can you tell me how to handle this?
>>>
>>> LJ> The problem is these hosts are not fixed IP's so they use no-ip
>>> LJ> (http://www.no-ip.com/) to provide a fixed address.
>>>
>>> It's possible to populate the table after network initialized and all
>>> other cervices are up. Just place empty table
>>>
>>> table <goodguys> persist
>>>
>>> in your pf.conf and
>>>
>>> pfctl -t goodguys -T add \
>>>  something.somewhere.com \
>>>  somethingelse.somewhere.com \
>>>   xxx.yyy.zzz.qqq &
>>>
>>> into your /etc/rc.local, so pf will start up without delays.
>>>
>>
>> I forgot to mention that I'm on a FreeBSD 7 system so the rc.local thing 
>> must go somewhere else, do you know where?
>> 
LJ> If I've understood this right this will only be right at the time the
LJ> machine starts. How do I get to know if the hosts changes their 
LJ> addresses. Should I invoke a cron job that does the same as you suggested?
LJ> Thanks

Yes. Also you would have to clear the table before loading new IP
addresses into it. Querying authoritative server with, for example
`nslookup`, instead of relying on local resolver would make this thing
more robust.

Regards,
  Dennis.