diff options
| author | Peter Wemm <peter@FreeBSD.org> | 1997-09-10 03:07:14 +0000 |
|---|---|---|
| committer | Peter Wemm <peter@FreeBSD.org> | 1997-09-10 03:07:14 +0000 |
| commit | ffdd472de7a1a10f7f8fc8a0b5b343d52eb10d22 (patch) | |
| tree | 495f9f1c97e7c3e328aab0c824a1c91e4a6ba421 /sys/conf/NOTES | |
| parent | 10a91a42fcf18d46c35200a4531fc497a4456389 (diff) | |
| download | src-ffdd472de7a1a10f7f8fc8a0b5b343d52eb10d22.tar.gz src-ffdd472de7a1a10f7f8fc8a0b5b343d52eb10d22.zip | |
Allow a compile-time override of the ipfw deny rule. For a 'firewall'
you don't want this (and the documentation explains why), but if you
use ipfw as an as-needed casual filter as needed which normally runs as
'allow all' then having the kernel and /sbin/ipfw get out of sync is a
*MAJOR* pain in the behind.
PR: 4141
Submitted by: Heikki Suonsivu <hsu@mail.clinet.fi>
Notes
Notes:
svn path=/head/; revision=29268
Diffstat (limited to 'sys/conf/NOTES')
| -rw-r--r-- | sys/conf/NOTES | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/sys/conf/NOTES b/sys/conf/NOTES index 9e84fa07a233..e470f533e1ff 100644 --- a/sys/conf/NOTES +++ b/sys/conf/NOTES @@ -2,7 +2,7 @@ # LINT -- config file for checking all the sources, tries to pull in # as much of the source tree as it can. # -# $Id: LINT,v 1.362 1997/09/04 23:03:09 yokota Exp $ +# $Id: LINT,v 1.363 1997/09/09 12:40:53 jmg Exp $ # # NB: You probably don't want to try running a kernel built from this # file. Instead, you should start from GENERIC, and add options from @@ -368,6 +368,13 @@ pseudo-device tun 1 #Tunnel driver(user process ppp) # conjunction with the `ipfw' program. IPFIREWALL_VERBOSE sends # logged packets to the system logger. IPFIREWALL_VERBOSE_LIMIT # limits the number of times a matching entry can be logged. +# IPFIREWALL_DEFAULT_TO_ACCEPT causes the default rule (at boot) to +# allow everything. Use with care, if a cracker can crash your +# firewall machine, they can get to your protected machines. However, +# if you are using it as an as-needed filter for specific problems as +# they arise, then this may be for you. Changing the default to 'allow' +# means that you won't get stuck if the kernel and /sbin/ipfw binary get +# out of sync. # # IPDIVERT enables the divert IP sockets, used by ``ipfw divert'' # @@ -379,6 +386,7 @@ options IPFIREWALL #firewall options IPFIREWALL_VERBOSE #print information about # dropped packets options "IPFIREWALL_VERBOSE_LIMIT=100" #limit verbosity +options IPFIREWALL_DEFAULT_TO_ACCEPT #allow everything by defalt options IPDIVERT #divert sockets options TCPDEBUG |