Date: Thu, 8 May 2008 02:54:39 +0800 From: "Justin Jereza" <justinjereza@gmail.com> To: Mel <fbsd.questions@rachie.is-a-geek.net>, freebsd-questions@freebsd.org Subject: Re: Delaying pf.conf loading Message-ID: <53f591170805071154q21275ffbs53cb8ab57175752e@mail.gmail.com> In-Reply-To: <200805072028.51152.fbsd.questions@rachie.is-a-geek.net> References: <53f591170805071021i45f757d3h4558e106a0da7f18@mail.gmail.com> <200805072028.51152.fbsd.questions@rachie.is-a-geek.net>
next in thread | previous in thread | raw e-mail | index | archive | help
That ought to work. Thanks! :-)
On Thu, May 8, 2008 at 2:28 AM, Mel <fbsd.questions@rachie.is-a-geek.net> wrote:
>
> On Wednesday 07 May 2008 19:21:22 Justin Jereza wrote:
> > Hello.
> >
> > Is it possible to delay the loading of pf rules from pf.conf after ppp
> > has connected and named is running through rc.conf?
>
> No, the design of the rc system does not allow for rc.conf to alter the order
> of the scripts executed, since rc.conf is loaded on a per-script basis and
> the ordering is done based on 'comments' in the scripts themselves.
>
> You can however, load an empty table with the appropreate name, then create an
> rc script in /usr/local/etc/rc.d/ that fills the table with hostnames to
> solve your problem.
>
> Here's an example:
>
> /etc/rc.conf:
> pf_dyntables_enable="YES"
> pf_dyntables_list="adservers"
>
> /etc/pf.conf:
> table <adservers> persist
>
> /etc/pf/dynamic/adservers:
> cdn.fastclick.net
> ad.doubleclick.net
> # etc etc
>
> /usr/local/etc/rc.d/pf_dyntables:
>
> #!/bin/sh
> #
> # PROVIDE: pf_dyntables
> # REQUIRE: named pf ppp
>
> . /etc/rc.subr
>
> name="pf_dyntables"
> rcvar=`set_rcvar`
> start_cmd="${name}_start"
> stop_cmd=":"
>
> load_rc_config $name
>
> : ${pf_dyntables_enable="NO"}
> : ${pf_dyntables_dir="/etc/pf/dynamic"}
> : ${pf_dyntables_list="NONE"}
>
> pf_dyntables_start()
> {
> if test x"${pf_dyntables_list}" != x"NONE"; then
> for table in ${pf_dyntables_list}; do
> echo "Loading table <$table>"
> cat ${pf_dyntables_dir}/${table} |/usr/bin/xargs \
> ${pf_program} -t ${table} -Tadd
> done
> else
> echo hi
> fi
> }
>
> run_rc_command "$1"
>
>
> --
> Mel
>
> Problem with today's modular software: they start with the modules
> and never get to the software part.
>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?53f591170805071154q21275ffbs53cb8ab57175752e>