The ipfw functionality is a valuable part of FreeBSD, however
compiling it into the kernel or enabling the option in rc.conf (which
currently loads the kernel module from rc.network) can lead to a system
accidentally being closed off from the internet.  This is especially
dangerous when administering a system remotely.

Fix: The following patch (in both unified and context format because I
can never remember what y'all like :) make a few small changes to rc.conf
to make things more clear, add some safety features to rc.network and
rc.firewall so that the default firewall type is open, and makes sure that
rc.firewall is loaded if there is ipfw functionality in the kernel.  It
also makes a small change to the rc.firewall script so that the rules in
the script look like the rules you see when doing 'ipfw list.'  Finally it
makes rc.firewall and rc.network friendlier to a mistake in case for "YES"
vs. "yes."

	I realize that making the default rule "open" is a controversial
thing, however it would be trivial for someone who *wanted* a closed
system to make the firewall type "CLOSED." On the other hand, someone
compiling the ipfw option into the kernel or enabling it in rc.conf
without doing their "homework" will find themself with anything from a 
mysterious situation to a catastrophic error for someone administering a
system remotely. 

	Even if the powers that be do not accept my proposal for changing
the default rule, I'd like serious consideration for the expanded and
clarified warning messages, and the change from "pass all" to "allow ip"
in rc.firewall.  

	There is currently a discussion on this topic happening on
freebsd-stable.

Hope this helps,

Doug


Context format:

Unified format:
How-To-Repeat: 
	Load ipfw.