Date: Wed, 4 Apr 2007 13:10:20 GMT From: Bas van Beek<bas@tobin.nl> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/111225: missing option "syncpeer" in pfsync startup script Message-ID: <200704041310.l34DAKGV084178@www.freebsd.org> Resent-Message-ID: <200704041320.l34DK8KP085966@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 111225
>Category: misc
>Synopsis: missing option "syncpeer" in pfsync startup script
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: change-request
>Submitter-Id: current-users
>Arrival-Date: Wed Apr 04 13:20:07 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator: Bas van Beek
>Release: 6.1 RELEASE
>Organization:
>Environment:
FreeBSD fw1.tobin.nl 6.1-RELEASE FreeBSD 6.1-RELEASE #2: Tue Apr 3 15:12:20 UTC 2007 bas@fw1.tobin.nl:/usr/obj/usr/src/sys/FW i386
>Description:
pfsync can take the argument syncpeer so it will use a single peer ip address instead of a multicast address to inform the other pf firewall of state changes.
The /etc/rc.d/pfsync startup script does not facilitate this option.
>How-To-Repeat:
>Fix:
A minor update of the pfsync script would allow for this option to be included in the rc.conf script:
if [ -z "$pfsync_syncpeer" ] ; then
ifconfig pfsync0 syncdev $pfsync_syncdev $pfsync_ifconfig up
else
ifconfig pfsync0 syncpeer $pfsync_syncpeer syncdev $pfsync_syncdev $pfsync_ifconfig up
fi
this would allow for the following configuration in rc.conf
pfsync_enable="YES"
pfsync_syncdev="em3"
pfsync_syncpeer="10.0.0.1"
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200704041310.l34DAKGV084178>