PF and DHCP

[Jonathan Belson]

Hiya

I have a server which acts as a gateway between the internet and my  
internal network.  The external interface receives its IP address via  
DHCP.  I set up pf.conf to allow DHCP packets via ports 67/68, but I  
notice that when the server boots, the DHCP exchange happens /before/  
PF gets started.

Does this mean that adding rules for DHCP isn't necessary (my firewall  
rules are block in/pass out, with a bit of NAT thrown in)?

Does this mean that when my machine boots, there's a window between  
the interfaces coming up and the firewall being enabled?

Thanks,

--Jon