Skip site navigation (1)Skip section navigation (2) 
Date:      Thu, 21 May 2009 12:41:22 -0400
From:      Steve Bertrand <steve@ibctech.ca>
To:        Freddie Cash <fjwcash@gmail.com>
Cc:        freebsd-ipfw@freebsd.org
Subject:   Re: Does ipfw support interface groups?
Message-ID:  <4A158432.5050303@ibctech.ca>
In-Reply-To: <b269bc570905210849s202084d2h15e991683d1b112b@mail.gmail.com>
References:  <9a542da30905210720y50fafe59ld3459c9e76ef5824@mail.gmail.com>	<20090521150113.GA47160@onelab2.iet.unipi.it> <b269bc570905210849s202084d2h15e991683d1b112b@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help 

[-- Attachment #1 --]
Freddie Cash wrote:
> On Thu, May 21, 2009 at 8:01 AM, Luigi Rizzo <rizzo@iet.unipi.it> wrote:
>> On Thu, May 21, 2009 at 04:20:48PM +0200, Ermal Lu?i wrote:
>>> can ipfw use somehow interface groups as pf(4) can?
>>> From a quick glance at documentation and not so through look at code
>>> it does not but i am sending this just if i missed something during my
>>> search!
>> something like
>>        ... { recv ed0 or recv xl1 or recv ath4 or recv vlan0 } ...
>> is perhaps not so nice but does the job.
> 
> Seriously??!!
> 
> Luigi, you just made my day.  :)  Writing duplicate sets of rules for
> multi-homed firewalls where the only thing that's different is the
> incoming interface has been a pain ...

Aside from Luigi's piece of trickery, if you are accustomed to making
frequent changes to live rulesets (and then promptly
forgetting/neglecting to add them into your startup scripts), might I
recommend something that has become very useful to me:

I have /etc/ipfw.rules which contains the variable definitions and all
table configurations as my primary startup script. At the bottom of that
file, I have:

. /etc/ipfw.include

This instructs the sh script to pick up the data from the ipfw.include
file, and process it as well.

Instead of implementing the rules live, and then adding them into the
startup script manually, I simply (from time-to-time) run this
(copy/paste into CLI):

ipfw list | \
perl -nle 's/table\((\d+)\)/\"table($1)"/g; print "\$cmd $_";' \
> /etc/ipfw.include
chown root:wheel /etc/ipfw.include && chmod 400 /etc/ipfw.include

That then makes a copy of your current live ruleset into your
/etc/ipfw.include file, which will be loaded upon next reboot.

Steve


[-- Attachment #2 --]
0	*H
010	+0	*H
00CK9AbxIUw0
	*H
0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
090507231610Z
100507231610Z0B10UThawte Freemail Member10	*H
	steve@ibctech.ca0"0
	*H
0
DZ杙<2IⵀfrsE6q?0.>
S@Œ!V?A\Q
r-aZ
Ōf/0{OYQhɏߴ
F_\Q0BF=<_.a*3epeY|tݼcvlҷ+@piQA{2E9WN4[Z`h6VM/zPbd(GC^K6XV4j<t-0+0U0steve@ibctech.ca0U00
	*H
æ|85aQz-*3HG		.s*Fw*`HvFw;9ytƘn0taC/:WC+LÙ{Oq 1n00CK9AbxIUw0
	*H
0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
090507231610Z
100507231610Z0B10UThawte Freemail Member10	*H
	steve@ibctech.ca0"0
	*H
0
DZ杙<2IⵀfrsE6q?0.>
S@Œ!V?A\Q
r-aZ
Ōf/0{OYQhɏߴ
F_\Q0BF=<_.a*3epeY|tݼcvlҷ+@piQA{2E9WN4[Z`h6VM/zPbd(GC^K6XV4j<t-0+0U0steve@ibctech.ca0U00
	*H
æ|85aQz-*3HG		.s*Fw*`HvFw;9ytƘn0taC/:WC+LÙ{Oq 1n0?0
0
	*H
010	UZA10UWestern Cape10U	Cape Town10U
Thawte Consulting1(0&UCertification Services Division1$0"UThawte Personal Freemail CA1+0)	*H
	personal-freemail@thawte.com0
030717000000Z
130716235959Z0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA00
	*H
0Ħ<UsUNʙZhup[v:aQP
0cZ,p+Z?qV˯<6$*+w=+>@dקe*TH<a@dr`00U00CU<0:08642http://crl.thawte.com/ThawtePersonalFreemailCA.crl0U0)U"0 010UPrivateLabel2-1380
	*H
HP.
fgCL!6-6/P p<ab:~t%Pb'qW%ݩ9 Oe_N4[5MwV!x!5$F]_eO1d0`0v0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAK9AbxIUw0	+0	*H
	1	*H
0	*H
	1
090521164122Z0#	*H
	1+kbHrAK0R	*H
	1E0C0
*H
0*H
0
*H
@0+0
*H
(0	+71x0v0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAK9AbxIUw0*H
	1xv0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAK9AbxIUw0
	*H
e	{*c2yvsuo48B&JB2r̔:c֟/
^T$w쿹szdEeEg"(\KMqB+vZT<c7
Wc(b4Ob*|=,QYEjXrQ
.Lg8t&PXO7ͺrޝX936.J>:ErR{L;3@=Jel^

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4A158432.5050303>