Subject: ipfirewall and rc.d scripts
To: None <>
From: Michal Stepien <>
List: tech-security
Date: 07/13/2005 10:27:10
Problem relates to netbsd 2.0.2-STABLE on i386.

In /etc/rc.conf I have something like this:
# dhclient) may be needed to get the network operational enough to mount
#dhclient=YES                           # behave as a DHCP client
ipnat=YES                                       # uses /etc/ipnat.conf
ipfilter=YES                                    # uses /etc/ipf.conf
ipmon=YES               ipmon_flags="-Dns"      # syslog ipfilter
altqd=YES               altqd_flags=""
securelevel="1"                                 # securelevel to set to
dhcpd=YES               dhcpd_flags="-q"
fsck_flags="-p -y"

Ipfilter and ipnat rules seems to be proper but neither ipfilter nor
ipnat do not work after system startup.
ipf -V prints:

ipf: IP Filter: v4.1.3 (396)
Kernel: IP Filter: v4.1.3               
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 0
Feature mask: 0x10a

To make it workable I had to put in /etc/rc.local something like this:

cd /etc/rc.d && ./ipfilter restart && ./ipnat restart

In the same netbsd on macppc everything is ok. What is wrong?

michal stepien