From owner-freebsd-questions@FreeBSD.ORG Mon Apr 4 16:06:43 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E614C16A4CE for ; Mon, 4 Apr 2005 16:06:43 +0000 (GMT) Received: from rproxy.gmail.com (rproxy.gmail.com [64.233.170.200]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5142343D5D for ; Mon, 4 Apr 2005 16:06:43 +0000 (GMT) (envelope-from perikillo@gmail.com) Received: by rproxy.gmail.com with SMTP id a41so1238111rng for ; Mon, 04 Apr 2005 09:06:43 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type; b=c7qrKTR8b1BYF+OnWuNHnvypAH8ndYLTN5A/k4ISBSZy0bBTXc7X7ZgpLtzhMJLle5jeuVC+0YPJ5lmVrRqZ8zj6PIu2OpfVL1kNPATg+wW1dIAtwryf9ZhGpkqWOX2JCXsz7NTKipX3Y5NadiJM1mjVgKjWtp6/nehPQvWTP+Y= Received: by 10.38.160.52 with SMTP id i52mr5342162rne; Mon, 04 Apr 2005 09:06:41 -0700 (PDT) Received: by 10.38.98.28 with HTTP; Mon, 4 Apr 2005 09:06:41 -0700 (PDT) Message-ID: <51d7a516050404090660bb68ed@mail.gmail.com> Date: Mon, 4 Apr 2005 09:06:41 -0700 From: perikillo To: freebsd-questions@freebsd.org Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline X-Content-Filtered-By: Mailman/MimeDel 2.1.1 Subject: Securelevel dont let ipf read rules... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: perikillo List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Apr 2005 16:06:44 -0000 Hi all, i was testing my firewaill with Freebsd 4.11 Release and ipf on th= e=20 kernel. I have ppp setup to run on every time i turn on the system, i was= =20 using securelevel=3D2 on the /etc/sysctl.conf kern.securelevel=3D2 and /etc/rc.conf /etc/rc.conf: kernel_securelevel=3D2 After i see that my firewall was ready to start his job, i decide to change= =20 the secure level to paranoid level and change the secure level to 3: /etc/sysctl.conf: kern.securelevel=3D3 /etc/rc.conf: kernel_securelevel=3D3 Went i restart my computer, and try to access with my other computer wich= =20 use Windows 2k, i try to access the internet, and see that my browser dont= =20 find nothing, make some test on it, but no access to the outside world. I g= o=20 back to my firewall and test the conecction: test#ifconfig This show that i was conected, then test with ping, fastest_cvsup none of= =20 then reach the outside world. After this i test ipf : test#ipfstat -hio upsssssssssssssss, dont have any rules on my firewall, the i go to: test# ee /var/log/console I go to the end of the file and read my last boot up messages and see that= =20 went my system try read the /etc/ipf.rules and /etc/ipmon.rules the system= =20 secure level=3D3 on /etc/syctl.conf dont let ipf and ipnat to charge his ru= les=20 set.=20 "Operation Not Permite" (something like this mmmm dont remember the right= =20 messages :-\) /etc/sysctl.conf goes before /etc/rc.conf, i was thinking that if i setup= =20 securelevel=3D1 on sysctl.conf and then on rc.conf after ipf and ppp start,= =20 setup securelevel to 3, but my rc.conf dosent do nothing.=20 How can i reach securelevel=3D3 and run my firewall, i dont want to input= =20 nothing directly i want that baby(freebsd) do every thing automatically,=20 maybe i need to setup a script??? Or i am doing something wrong? I read man init but dont see nothing about this issue... Thanks all for your comments. NOTE: Freebsd 4.11 Release, ipfilter compile in the kernel. This machine ru= n=20 only my firewall no servers is an old pentium 100Mhz. I try to write my bes= t=20 english.