Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 5 Jan 2015 14:41:47 +0100
From:      =?ISO-8859-1?Q?Olivier_Cochard=2DLabb=E9?= <>
Cc:        "" <>, Luigi Rizzo <>
Subject:   Re: Why ipfw didn't filter neither log DHCP packets ?
Message-ID:  <>
In-Reply-To: <>
References:  <> <> <>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
On Mon, Jan 5, 2015 at 1:28 PM, Willy Offermans <>

> Hello Luigi and FreeBSD friends,
> I do top posting.
> So there might be a chance that someting slips through the firewall
> between the start of the firewall and after the bpf traffic of dhclient.
> Once the NIC is configured, traffic is possible in principle.
> Would it be better to start the bpf traffic of dhclient after the firewall
> runs. In the latter case, all will or can work as expected. If yes, how
> should this be set? Should one set
>  REQUIRE: firewall
> in /etc/rc.d/dhclient? But there seems no firewall daemon to be present. So
> I'm not sure how this should work.
I believe that when Luigi says "that acts before the firewall has a chance
to see the packets", he was not speaking of the RC script order, but about
the FreeBSD network stack layer order.
Do you confirm Luigi ?

Because I've tryed to fix ifpw's RC script order by changing:
- /etc/rc.d/ipfw: replaced "REQUIRE: ppp" by "REQUIRE: FILESYSTEMS" (like
- /etc/rc.d/netif: Add "ipfw" in the REQUIRE list

But no change: DHCP is still allowed.

Then, why there are specific DHCP-clients rules in /etc/rc.firewall script
(like in WORKSTATION mode) if there are useless ?

Want to link to this message? Use this URL: <>