From owner-freebsd-ipfw@FreeBSD.ORG  Wed Sep 15 15:57:06 2010
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: ipfw@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 6B4B6106564A
	for <ipfw@freebsd.org>; Wed, 15 Sep 2010 15:57:06 +0000 (UTC)
	(envelope-from lordcow@lordcow.org)
Received: from lordcow.org (lordcow.org [41.203.5.188])
	by mx1.freebsd.org (Postfix) with ESMTP id 910CD8FC1B
	for <ipfw@freebsd.org>; Wed, 15 Sep 2010 15:57:04 +0000 (UTC)
Received: from lordcow.org (localhost [127.0.0.1])
	by lordcow.org (8.14.4/8.14.4) with ESMTP id o8FFUVZP085390
	(version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO);
	Wed, 15 Sep 2010 17:30:31 +0200 (SAST)
	(envelope-from lordcow@lordcow.org)
Received: (from lordcow@localhost)
	by lordcow.org (8.14.4/8.14.4/Submit) id o8FFUNOr085388;
	Wed, 15 Sep 2010 17:30:23 +0200 (SAST) (envelope-from lordcow)
Date: Wed, 15 Sep 2010 17:30:23 +0200
From: Gareth de Vaux <bsd@lordcow.org>
To: Ian Smith <smithi@nimnet.asn.au>
Message-ID: <20100915153023.GA84975@lordcow.org>
Mail-Followup-To: Ian Smith <smithi@nimnet.asn.au>,
	Brandon Gooch <jamesbrandongooch@gmail.com>, ipfw@freebsd.org
References: <20100909131733.GA21535@lordcow.org>
	<AANLkTikjBA4aBXJ1JO+28CkNmcbC4qYkcmueTQhPnA0J@mail.gmail.com>
	<20100915134357.A73353@sola.nimnet.asn.au>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20100915134357.A73353@sola.nimnet.asn.au>
User-Agent: Mutt/1.4.2.3i
X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00
	autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on lordcow.org
Cc: Brandon Gooch <jamesbrandongooch@gmail.com>, ipfw@freebsd.org
Subject: Re: phantom rules
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Sep 2010 15:57:06 -0000

On Wed 2010-09-15 (14:39), Ian Smith wrote:
> Indeed, that's where these have come from (and Gareth, you DO want those
> rules, including the ipv6_mandatory ones if running ipv6)

I don't, because I run my own from my own file. (I'm not using ipv6
either).

> but I suspect that you may have rather intended this to be:
> 
> firewall_script="/usr/local/etc/firewall"

Nope I intended it as before - firewall_type="<filename>", and my file is
in the format you mention later, and it works, just preceded with that
stuff I didn't ask for.

The first line in /usr/local/etc/firewall for example is:

add pass all from any to any via lo0

so I end up with 2 of these rules, plus that other stuff.

So are there some variables I can set that disable this second-guessing
behaviour?