The following reply was made to PR conf/167566; it has been noted by GNATS.
From: Chris Rees <[email protected]> To: [email protected] Cc: Subject: Re: conf/167566 Date: Sat, 27 Oct 2012 22:29:03 +0100 > Which module do you refer in "...the module is loaded, ...", > ipfw_nat.ko or ipdivert.ko? > > In my understanding the problem occurs only when ipfw attempts to > load firewall rules including a "divert" directive and ipdivert.ko is > not loaded at that time. natd(8) also requires ipdivert.ko, but > rc.d/natd already has required_modules="ipdivert". > firewall_nat_enable is a knob for in-kernel NAT (this requires > ipfw_nat.ko), so more orthogonal way would be like the following > patch: > > http://people.allbsd.org/~hrs/FreeBSD/ipfw.20121028-1.diff > > It is still unclear to me what is harmful with "checkyesno > natd_enable" here. Can you elaborate it a little more? Check rcorder: [crees@pegasus]~% rcorder /etc/rc.d/* | grep -E 'natd|ipfw' /etc/rc.d/ipfw /etc/rc.d/natd That means that natd doesn't run until after ipfw. This means that on boot, when ipfw runs, neither ipfw_nat nor ipdivert are installed, *regardless of the state of natd_enable*. Therefore, checkyesno natd_enable does not guarantee that either ipfw_nat or ipdivert is loaded *at the time rc.d/ipfw is run*. Chris _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-rc To unsubscribe, send any mail to "[email protected]"
