On Wed, Apr 20, 2005 at 09:44:59PM +0930, alex wilkinson wrote: > EXT_IF="tun0" > > I want to refer to this interface in parentheses in case tun0's DHCP > ip address changes. > However, when I use the (...) feature in the following rule for example: > > block return-rst in log on ($EXT_IF) proto tcp all
The 'on interface' part takes an interface as argument, not an IP address. So just use 'on tun0' there, without the parentheses. It doesn't matter whether that interface changes IP addresses or not, it's still the same interface. You must have 'from address' or 'to address' in mind, which take IP addresses as arguments. You can use an interface name in those contexts, which means 'take the (first) address of that interface', or, when put in parentheses, 'dynamically use the (first) address of that interface, even if it changes'. So, ($EXT_IF) applies only to the 'from' and 'to' parts, never to the 'on' part. Daniel
