Bruce M. Simpson wrote:
Pete French wrote:
Am trying to solve a little problem with 'pf'. I have a ruleset which
has some firewall rules for the IPv6 interface stf0. This works fine,
except when I rreboot the machine, as the pf script is run before the
network_ipv6 script - so stf0 does not exist. but I cannot work out
how to arrange for stf0 to be created before the pf script is run - as
network_ipv6 requires 'routing', but the pf script says it must be run
before 'routing', if I am reading the 'REQUIRE' and 'BEFORE' lines
correctly.
Just chiming in to confirm that this problem definitely exists.
I don't have a solution, however, my IPv6 tunnels at home have all
expired, so I may well get spare cycles to look at this the same time
that I get spare cycles to revive the tunnels.
BMS
Essentially the same problem exists with pf and ppp. The tun device (on which most of my pf rules
depend) does not yet exist when pf is started.
Apparently, someone has looked at this before, since there are commands to resync pf and ipf inside
the rc.d script for ppp (in ppp_postcmd). But this still doesn't work, since ppp is still
negotiating the connection when this function is run, so pf fails a second time. My solution was to
jam a "sleep 15" inside ppp_postcmd() right before the point the commands to reload pf and ipf are
run. It's major ugly, but it works. Hopefully someone will find a better solution to these problems.
Richard Coleman
[EMAIL PROTECTED]
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
