pf.conf for variable interfaces

[Erik Norgaard]

Jim Bow wrote:
> Erik Norgaard wrote:
>> How about this:
>>
>> ext_ifs = "{" iwi0 bge0 "}"
>> block in quick on ext_ifs all
>> pass out quick on ext_ifs all keep state
>> ...
> 
> This is nice, but any ideas how to do this if the wireless interface 
> is only present some of the time, ie its a pcmcia card?

If the above trick doesn't work, then I don't think there is an easy 
solution, pf fails loading rulesets when an error is encountered, which 
AFAIK would happen if an interface is not present.

An option could be to load rule sets as part of the interface setup. 
That means messing with the scripts in /etc/rc.d.

If you look in netif, then there is as part of the start() routine, a 
part that resyncs ipfilter. You can probably copy/paste this to do the 
same if pf is enabled and add a similar resync command to the pf script.

Just some ideas.

Cheers, Erik

-- 
Erik Nørgaard
Ph: +34.666334818                           http://www.locolomo.org