On Wed, Nov 9, 2011 at 12:44 PM, Nick Hilliard <n...@foobar.org> wrote: > On 09/11/2011 19:07, C. Jon Larsen wrote: >> >> put the main portion of the conf in subversion as an include file and >> factor out local differences in the configs with macros that are defined >> in >> pf.conf >> >> Easy. > > As I said, it's not a pf problem. Commercial firewalls will do all this > sort of thing off the shelf. It's a pain to have to write scripts to do > this manually.
Agreed. This is rather a pain to have to do manually each time (either scp'ing or scripting). It's unfortunate that there's not a conventional script or mechanism for doing this. I have plenty of scripts from past commercial work that do this, but they're sadly tied up license-wise. I've had good luck, pf-wise, with creating a ruleset that is just identical between hosts. By keeping the interface naming/numbering scheme consistent across two hosts, the same configuration can just "work" on both. Cheers, jof
