From owner-freebsd-questions@FreeBSD.ORG Tue Apr 10 19:26:38 2007 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 409BD16A400 for ; Tue, 10 Apr 2007 19:26:38 +0000 (UTC) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: from mail4.sea5.speakeasy.net (mail4.sea5.speakeasy.net [69.17.117.6]) by mx1.freebsd.org (Postfix) with ESMTP id 1EDE513C459 for ; Tue, 10 Apr 2007 19:26:38 +0000 (UTC) (envelope-from freebsd-questions-local@be-well.ilk.org) Received: (qmail 16509 invoked from network); 10 Apr 2007 19:26:37 -0000 Received: from dsl092-078-145.bos1.dsl.speakeasy.net (HELO be-well.ilk.org) ([66.92.78.145]) (envelope-sender ) by mail4.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP for ; 10 Apr 2007 19:26:37 -0000 Received: by be-well.ilk.org (Postfix, from userid 1147) id B589028434; Tue, 10 Apr 2007 15:26:36 -0400 (EDT) To: "J.D. Bronson" References: <200704101334.l3ADY1MJ006807@shadow.sixcompanies.com> From: Lowell Gilbert Date: Tue, 10 Apr 2007 15:26:36 -0400 In-Reply-To: <200704101334.l3ADY1MJ006807@shadow.sixcompanies.com> (J. D. Bronson's message of "Tue\, 10 Apr 2007 08\:34\:51 -0500") Message-ID: <44mz1gqbdf.fsf@be-well.ilk.org> User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.0.97 (berkeley-unix) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: freebsd-questions@freebsd.org Subject: Re: ipfilter and DHCP X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: freebsd-questions@freebsd.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Apr 2007 19:26:38 -0000 "J.D. Bronson" writes: > Ok...what do you guys do to handle a change of IP/network via DHCP > with ipfilter? > > I have been told that if my IP changes while the machine is up and > running that ipfilter WON'T see this change and needs to be > told...supposedly it only reads the IP when it starts itself. > > If this is true, is there any easy way to fix this? > I run ipcheck.py and that can invoke a script if needed if it notices > and IP changed.... > > ipnat.conf: > map bge1 192.43.82.0/24 -> 0/32 proxy port ftp ftp/tcp > map bge1 192.43.82.0/24 -> 0/32 portmap tcp/udp auto > map bge1 192.43.82.0/24 -> 0/32 > > rdr bge1 0.0.0.0/0 port 25 -> 192.43.82.170 port 25 > > > I presume if it reads the IP and fills in the '0/32' + '0.0.0.0/0' > values at startup...having my IP change could be disasterous. When your IP changes, you can have dhclient trigger a script of your choosing. You can use that to alter your firewall rules. There are probably other approaches too.