Re: PF Feature request: graceful handling of non-lookupable hosts.

2006-02-27 Thread Peter N. M. Hansteen
[EMAIL PROTECTED] writes: PF sqawcks if a hostname in any of it's files are not currently findable. Is there a reasonable way to have it gracefully skip missing hosts and carry on? Putting host names in your PF config files is a practice that comes with warnings in large, friendly, red and

Re: PF Feature request: graceful handling of non-lookupable hosts.

2006-02-27 Thread Damien Miller
On Mon, 26 Feb 2006, [EMAIL PROTECTED] wrote: PF sqawcks if a hostname in any of it's files are not currently findable. Is there a reasonable way to have it gracefully skip missing hosts and carry on? So you firewall rules can be silently skipped during times of DNS outage or DoS? That

Re: PF Feature request: graceful handling of non-lookupable hosts.

2006-02-27 Thread Karl O. Pinc
On 02/26/2006 04:38:12 PM, [EMAIL PROTECTED] wrote: PF sqawcks if a hostname in any of it's files are not currently findable. Is there a reasonable way to have it gracefully skip missing hosts and carry on? No. The best you can do is: 1) Do not use hostnames for hosts outside your DNS

Re: PF Feature request: graceful handling of non-lookupable hosts.

2006-02-27 Thread Peter N. M. Hansteen
Travis H. [EMAIL PROTECTED] writes: The TTL is controlled by the authoritative name server, though. And what about dynamic DNS? I wouldn't want to go there. The domain name system is fairly good at what it was designed to do, unfortunately firewall configs did not enter into the equation at