Date: Fri, 08 Feb 2008 20:25:41 +0100 From: Erik Norgaard <norgaard@locolomo.org> To: Jim Bow <jimbow@darq.net> Cc: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: Re: pf.conf for variable interfaces Message-ID: <47ACACB5.5010705@locolomo.org> In-Reply-To: <47ACA811.3000104@darq.net> References: <20080208133822.GA46647@demeter.hydra> <47AC5EE3.1010003@locolomo.org> <47ACA811.3000104@darq.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Jim Bow wrote:
> Erik Norgaard wrote:
>> How about this:
>>
>> ext_ifs = "{" iwi0 bge0 "}"
>> block in quick on ext_ifs all
>> pass out quick on ext_ifs all keep state
>> ...
>
> This is nice, but any ideas how to do this if the wireless interface
> is only present some of the time, ie its a pcmcia card?
If the above trick doesn't work, then I don't think there is an easy
solution, pf fails loading rulesets when an error is encountered, which
AFAIK would happen if an interface is not present.
An option could be to load rule sets as part of the interface setup.
That means messing with the scripts in /etc/rc.d.
If you look in netif, then there is as part of the start() routine, a
part that resyncs ipfilter. You can probably copy/paste this to do the
same if pf is enabled and add a similar resync command to the pf script.
Just some ideas.
Cheers, Erik
--
Erik Nørgaard
Ph: +34.666334818 http://www.locolomo.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?47ACACB5.5010705>