Date: Sun, 28 Jan 2007 10:33:41 -0500 From: Richard Coleman <rcoleman@criticalmagic.com> To: "Bruce M. Simpson" <bms@FreeBSD.org> Cc: freebsd-stable@FreeBSD.ORG, Pete French <petefrench@ticketswitch.com> Subject: Re: impossible rc.d ordering problem with stf and pf ? Message-ID: <45BCC255.3010101@criticalmagic.com> In-Reply-To: <45BC97E2.4050603@FreeBSD.org> References: <E1HAsD1-0004VZ-3B@dilbert.ticketswitch.com> <45BC97E2.4050603@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Bruce M. Simpson wrote: > Pete French wrote: >> Am trying to solve a little problem with 'pf'. I have a ruleset which >> has some firewall rules for the IPv6 interface stf0. This works fine, >> except when I rreboot the machine, as the pf script is run before the >> network_ipv6 script - so stf0 does not exist. but I cannot work out >> how to arrange for stf0 to be created before the pf script is run - as >> network_ipv6 requires 'routing', but the pf script says it must be run >> before 'routing', if I am reading the 'REQUIRE' and 'BEFORE' lines >> correctly. >> > Just chiming in to confirm that this problem definitely exists. > I don't have a solution, however, my IPv6 tunnels at home have all > expired, so I may well get spare cycles to look at this the same time > that I get spare cycles to revive the tunnels. > > BMS Essentially the same problem exists with pf and ppp. The tun device (on which most of my pf rules depend) does not yet exist when pf is started. Apparently, someone has looked at this before, since there are commands to resync pf and ipf inside the rc.d script for ppp (in ppp_postcmd). But this still doesn't work, since ppp is still negotiating the connection when this function is run, so pf fails a second time. My solution was to jam a "sleep 15" inside ppp_postcmd() right before the point the commands to reload pf and ipf are run. It's major ugly, but it works. Hopefully someone will find a better solution to these problems. Richard Coleman rcoleman@criticalmagic.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?45BCC255.3010101>