Date: Wed, 15 Jun 2005 11:46:03 +0100 From: Alex Zbyslaw <xfb52@dial.pipex.com> To: Joe <josepha48@yahoo.com> Cc: freebsd-questions@freebsd.org Subject: Re: SMP and networking under FreeBSD 5.3 Message-ID: <42B006EB.5050901@dial.pipex.com> In-Reply-To: <20050615051434.84720.qmail@web41012.mail.yahoo.com> References: <20050615051434.84720.qmail@web41012.mail.yahoo.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Joe wrote:
>Hey thanks,
>
> it seems that ipfw complains during boot with a message:
>
>hostname ``or'' unknown
>
> which I have no idea where that is coming from yet, but will
>look.
>
> Then natd doesn't get started.
>
> If I run /etc/rc.d/ipfw start then the router is up and natd
>gets started.
>
> For now, I'll probably just add it to rc at the end. I think
>it has something to do with the order things get run.
>
> My firewall script is for a dhcp interface. Since I don't
>know the IP, I use ifconfig dc0 | grep -v inet6 | grep inet |
>awk ... to get the IP address for some of the rules. I'm
>wondering if this is failing and causing the message above.
>
> Is there a 'recommended' way to create a rule for ipfw on a
>dhcp interface using its IP address?
>
>
>
You don't need any of your awk/grep palaver. Your ipfw rules should
probably be specifying the interface not ip addresses. Natd with
-dynamic will do the right thing when dhcp picks up its actual ip address.
from man natd
-dynamic If the -n or -interface option is used, natd will
monitor the
routing socket for alterations to the interface passed. If
the interface's IP address is changed, natd will
dynamically
alter its concept of the alias address.
I have, for example:
/etc/rc.conf:
ifconfig_sis0="DHCP" # External network
/etc/rc.firewall script
ipfw add divert natd all from any to any via sis0
and it all works just fine even though natd starts off saying that it
sees an IP address of 0.0.0.0
Your error message is very likely down to your "ifconfig | stuff"
command which may well run when there is no ip address configured.
It'll work fine when you run it once the ip address is configured, but
probably not before when the script actually runs.
Why do you think your firewall rules need to know the IP address? If
you do need it then ipfw2 (5.X only?) has "me". From man ipfw
me matches any IP address configured on an interface in the system.
The address list is evaluated at the time the packet is
analyzed.
If you have that after your natd rule, though, it will (I think) just
match everything so the interface name is good enough. e.g. from any to
any via sis0
--Alex
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?42B006EB.5050901>