On Thu, Nov 28, 2002 at 05:48:57AM -0800, Robert P. Thille wrote:
> 
> I'm using a qube2 as a gateway, so I need the GATEWAY option, and want 
> IPFILTER_LOG.  But when I build with GATEWAY and IPFILTER_LOG and the 
> ipfilter pseudo device turned on, my kernel comes out at more that 
> 2500000 which the FAQ says is too big.  Compressed it's under 1000000, 
> so I might be ok, but if not, what can I try?
> 
If it helps, this is my diff which lets me use ipf and IPSEC at the
expense of less verbose PCI and SCSI messages (the latter is less
important as I've also dropped SCSI support).  I've also killed NFS
but I must admit I'd like that back again - I just haven't the need
until after xmas, so haven't tried to fit it in again.  The extra
changes at the top do increase the image size, but let PostgreSQL
9from the ports tree) run without any mods.

The sizes are:

-rwxr-xr-x  1 root  wheel  2274786 Nov 12 23:30 /netbsd
-rwxr-xr-x  1 root  wheel  888260 Nov 12 23:31 /altroot/boot/vmlinux.gz

$ diff GENERIC ORCHARD
33,34c33,34
< #options 	SEMMNI=10	# number of semaphore identifiers
< #options 	SEMMNS=60	# number of semaphores in system
---
> options 	SEMMNI=256	# number of semaphore identifiers		(PGSQL)
> options 	SEMMNS=512	# number of semaphores in system		(PGSQL)
36c36
< #options 	SEMMNU=30	# number of undo structures in system
---
> options 	SEMMNU=256	# number of undo structures in system		(PGSQL)
38c38,39
< #options 	SHMMAXPGS=1024	# 1024 pages is the default
---
> options 	SHMMAXPGS=4096	# 1024 pages is the default			(PGSQL)
> #options		SEMMAP=256	#						(PGSQL)
68c69
< file-system	NFS		# Sun NFS-compatible filesystem client
---
> #file-system	NFS		# Sun NFS-compatible filesystem client
84c85
< options 	NFSSERVER	# Sun NFS-compatible filesystem server
---
> #options 	NFSSERVER	# Sun NFS-compatible filesystem server
92c93
< #options 	GATEWAY		# IP packet forwarding
---
> options 	GATEWAY		# IP packet forwarding
95,96c96,97
< #options 	IPSEC		# IP security
< #options 	IPSEC_ESP	# IP security (encryption part; define w/IPSEC)
---
> options 	IPSEC		# IP security
> options 	IPSEC_ESP	# IP security (encryption part; define w/IPSEC)
109c110
< #options 	IPFILTER_LOG	# ipmon(8) log support
---
> options 	IPFILTER_LOG	# ipmon(8) log support
114c115
< options 	PCIVERBOSE	# verbose PCI device autoconfig messages
---
> #options 	PCIVERBOSE	# verbose PCI device autoconfig messages
116c117
< options 	SCSIVERBOSE	# human readable SCSI error messages
---
> #options 	SCSIVERBOSE	# human readable SCSI error messages
136c137
< lcd0           at mainbus0
---
> #lcd0		at mainbus0
147c148
< ahc*		at pci? dev ? function ?	# Adaptec [23]94x, aic78x0 SCSI
---
> #ahc*		at pci? dev ? function ?	# Adaptec [23]94x, aic78x0 SCSI
157c158
< scsibus* 	at ahc?
---
> #scsibus* 	at ahc?
165,166c166,167
< sd*		at scsibus? target ? lun ?	# SCSI disk drives
< st*		at scsibus? target ? lun ?	# SCSI tape drives
---
> #sd*		at scsibus? target ? lun ?	# SCSI disk drives
> #st*		at scsibus? target ? lun ?	# SCSI tape drives
181c182
< pciide* 	at pci? dev ? function ? flags 0x0000
---
> pciide* 	at pci? dev ? function ? flags 0x0001
194c195
< wd* 		at pciide? channel ? drive ? flags 0x0000
---
> wd* 		at pciide? channel ? drive ? flags 0x0aaf
255c256
< #pseudo-device	ipfilter			# IP filter (firewall) and NAT
---
> pseudo-device	ipfilter			# IP filter (firewall) and NAT

HTH,
-- 
ian.