Michael Richardson
2010-07-05 01:30:31 UTC
I've just upgraded my firewall from NetBSD 1.6 to 5.1-RC3.
(Was going to be 5.0, but I thought to try 5.1. The problem with NetBSD
is that it's too reliable, so... you never upgrade... I'm actually
replacing 250W hardware with 60W hardware... for power consumption reasons)
Most things are fine, except for the ipf rules!
bud-[/etc] root 206 #/etc/rc.d/ipfilter start
Enabling ipfilter.
229:ioctl(add/insert rule): No such process
bud-[/etc] root 207 #sed -n 229p /etc/ipf.conf
pass in quick proto udp from any to any port = 500 group 200
If I comment out that line, then it's the next line.
(At one point ipf's line numbers were wrong, I think that got fixed)
[Obviously, this line lets IKE packets flow...]
This rule is the first rule that uses a group.
The group was declared a few lines earlier in a "head 200".
I basically divide my network policy into a group per interface.
I read through the man pages, and I don't see anything obvious.
I wish ioctl's could be more descriptive.
--
] He who is tired of Weird Al is tired of life! | firewalls [
] Michael Richardson, Sandelman Software Works, Ottawa, ON |net architect[
] ***@sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
Kyoto Plus: watch the video
then sign the petition.
--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de
(Was going to be 5.0, but I thought to try 5.1. The problem with NetBSD
is that it's too reliable, so... you never upgrade... I'm actually
replacing 250W hardware with 60W hardware... for power consumption reasons)
Most things are fine, except for the ipf rules!
bud-[/etc] root 206 #/etc/rc.d/ipfilter start
Enabling ipfilter.
229:ioctl(add/insert rule): No such process
bud-[/etc] root 207 #sed -n 229p /etc/ipf.conf
pass in quick proto udp from any to any port = 500 group 200
If I comment out that line, then it's the next line.
(At one point ipf's line numbers were wrong, I think that got fixed)
[Obviously, this line lets IKE packets flow...]
This rule is the first rule that uses a group.
The group was declared a few lines earlier in a "head 200".
I basically divide my network policy into a group per interface.
I read through the man pages, and I don't see anything obvious.
I wish ioctl's could be more descriptive.
--
] He who is tired of Weird Al is tired of life! | firewalls [
] Michael Richardson, Sandelman Software Works, Ottawa, ON |net architect[
] ***@sandelman.ottawa.on.ca http://www.sandelman.ottawa.on.ca/ |device driver[
Kyoto Plus: watch the video
then sign the petition.
--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-***@muc.de