Bug 130555

Summary: [ipfilter] [rc.d] [patch] No good way to set ipfilter variables at boot time
Product: Base System Reporter: G. Paul Ziemba <p-fbsd-bugs>
Component: confAssignee: freebsd-bugs (Nobody) <bugs>
Status: Open ---    
Severity: Affects Only Me    
Priority: Normal    
Version: 7.1-PRERELEASE   
Hardware: Any   
OS: Any   
Description Flags
file.diff none

Description G. Paul Ziemba 2009-01-14 18:30:01 UTC
ipfilter has a number of tunable variables (run "ipf -T list" to see the list). Although many (all?) of these are made available via sysctl, it is not possible to configure them in the context of the current /etc/rc.conf or /etc/sysctl.conf arrangements due to the following constraints/interactions:

1. Some of the tunables can be set only if ipfilter is disabled.

2. The current /etc/rc.d/ipfilter startup script enables ipfilter and
   causes it to load the filter rules before doing anything about
   ipfilter_flags, which might theoretically be set to "-D -T <foo> -E".

3. You could try ipfilter_flags="-D -T <foo> -E -f ${ipfilter_rules}" to
   reload the rules. However, ipfilter_flags are also used for the reload
   and resync commands of the startup script (i.e., later on), so you
   run into...

4. disabling ipfilter not only flushes existing configured filter rules, it
   also flushes any configured NAT rules (loaded independently via

5. /etc/sysctl.conf is processed after /etc/rc.d/ipfilter runs, so ipfilter
   tunables set in sysctl.conf fail due to ipfilter being enabled.

6. Oh, and they can't be set in /boot/loader.conf either

Here is a fix that allows variables to be specified in /etc/rc.conf so they will be set early in the /etc/rc.d/ipfilter script

Fix: Patch attached

Patch attached with submission follows:
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2009-01-16 22:44:56 UTC
Responsible Changed
From-To: freebsd-bugs->freebsd-net

Perhaps the folks on -net can evaluate this.
Comment 2 Cy Schubert freebsd_committer 2013-07-03 06:20:35 UTC
Responsible Changed
From-To: freebsd-net->cy

Comment 3 Eitan Adler freebsd_committer freebsd_triage 2017-12-31 07:58:38 UTC
For bugs matching the following criteria:

Status: In Progress Changed: (is less than) 2014-06-01

Reset to default assignee and clear in-progress tags.

Mail being skipped