Subject: Re: ipfilter LKM's for NetBSD on non-i386
To: Richard Michael <>
From: Manuel Bouyer <>
List: tech-net
Date: 05/12/2000 20:19:47
On Fri, May 12, 2000 at 12:49:48PM -0400, Richard Michael wrote:
> Ok.  So, if I can't build the latest ipf as a lkm, how should I go about this?
> Any advice?  How does the ipf that "ships" with the latest NetBSD work?
> How are the necessary hooks for the ipf provided at present?
> Are there patches for the kernel?  Are they already applied to the source
> tarball (since the ipf comes w/ netbsd) ?

ipf is integrated in NetBSD, so all hooks for different platforms have been
added at integration time. Is has some modifications over the stock ipf
to be better integrated in the system.

> Any tips on how to get this working?  I've inherited this 5000/240 and spent a
> long time learning about it and getting it up.  I don't really want to abandon
> it for i386.

If you don't need features of the last ipf, you can just use the ipf shipped
with 1.4.2, it's fine (I'm using it on 2 routers without problems).
Otherwise the easiest would be to upgrade your box to -current. There are
some tips on the NetBSD www site (basically, install the last snapshot,
get the last sources via sup, rsync or anoncvs and recompile).

If you know what you're doing you can try to port the last ipf to 1.4.2/pmax.
This should,'t be hard, just look at i386-specific files in the ipf sources
(these should be in sys/arch/i386) and do equivalent changes to
sys/arch/pmax or sys/arch/mips (machine and CPU dependant files are split for
pmax but not for i386). I'm not sure there are any C or assembly file
affected, it should be just a few changes to config files, to pull in
appropriate machine-independant files at compile time.

Manuel Bouyer <>