From owner-freebsd-ipfw@FreeBSD.ORG  Thu Sep  9 15:45:42 2010
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: ipfw@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 4C55510656E7
	for <ipfw@freebsd.org>; Thu,  9 Sep 2010 15:45:42 +0000 (UTC)
	(envelope-from julian@elischer.org)
Received: from out-0.mx.aerioconnect.net (outg.internet-mail-service.net
	[216.240.47.230])
	by mx1.freebsd.org (Postfix) with ESMTP id 3022D8FC17
	for <ipfw@freebsd.org>; Thu,  9 Sep 2010 15:45:41 +0000 (UTC)
Received: from idiom.com (postfix@mx0.idiom.com [216.240.32.160])
	by out-0.mx.aerioconnect.net (8.13.8/8.13.8) with ESMTP id
	o89FSATD008976; Thu, 9 Sep 2010 08:28:10 -0700
X-Client-Authorized: MaGic Cook1e
X-Client-Authorized: MaGic Cook1e
Received: from julian-mac.elischer.org
	(h-67-100-89-137.snfccasy.static.covad.net [67.100.89.137])
	by idiom.com (Postfix) with ESMTP id 7139B2D6016;
	Thu,  9 Sep 2010 08:28:09 -0700 (PDT)
Message-ID: <4C88FD27.2060901@elischer.org>
Date: Thu, 09 Sep 2010 08:28:39 -0700
From: Julian Elischer <julian@elischer.org>
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10.4; en-US;
	rv:1.9.2.9) Gecko/20100825 Thunderbird/3.1.3
MIME-Version: 1.0
To: Gareth de Vaux <bsd@lordcow.org>
References: <20100909131733.GA21535@lordcow.org>
In-Reply-To: <20100909131733.GA21535@lordcow.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.67 on 216.240.47.51
Cc: ipfw@freebsd.org
Subject: Re: phantom rules
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Sep 2010 15:45:42 -0000

On 9/9/10 6:17 AM, Gareth de Vaux wrote:
> Hi all, for some reason these rules get loaded on boot up before the
> ones I specify in a file:
>
> 00100   0     0 allow ip from any to any via lo0
> 00200   0     0 deny ip from any to 127.0.0.0/8
> 00300   0     0 deny ip from 127.0.0.0/8 to any
> 00400   0     0 deny ip from any to ::1
> 00500   0     0 deny ip from ::1 to any
> 00600   0     0 allow ipv6-icmp from :: to ff02::/16
> 00700   0     0 allow ipv6-icmp from fe80::/10 to fe80::/10
> 00800   0     0 allow ipv6-icmp from fe80::/10 to ff02::/16
> 00900   0     0 allow ipv6-icmp from any to any ip6 icmp6types 1
> 01000   0     0 allow ipv6-icmp from any to any ip6 icmp6types 2,135,136
>
> I just flush this manually but how do I stop the behaviour properly?
>
> My rc.conf entries:
>
> firewall_enable="YES"
> firewall_type="/usr/local/etc/firewall"

I think this is supposed to be one of the types supported in 
/etc/rc.firewall.

haven't actually looked at it for a while though.

> firewall_logging="YES"
> _______________________________________________
> freebsd-ipfw@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"