FreeBSD firewall configuration

[Ian Smith]

On Tue, 11 Apr 2017 22:25:03 +1000, Ian Smith wrote:
 > In freebsd-questions Digest, Vol 671, Issue 2, Message: 3
 > On Mon, 10 Apr 2017 21:37:47 +0200 Polytropon <freebsd at edvax.de> wrote:
 > 
 >  > > Can you also help me with the rule to forward incoming trafic to other
 >  > > interface?
 >  > 
 >  > You first need to put
 >  > 
 >  > 	net.inet.ip.forwarding=1
 >  > 
 >  > into /etc/sysctl.conf and make this change active (read: reboot or
 > 
 > Reboot?  Like Windows? :)
 > 
 >  > manually call "service sysctl restart".
 >  > 
 >  > Additionally, add
 >  > 
 >  > 	gateway_enable="YES" 
 >  > 
 >  > to /etc/rc.conf.
 > 
 > Just a minor niggle .. having gateway_enable="YES" in rc.conf causes 
 > net.inet.ip.forwarding=1 to be set by /etc/rc.d/routing, so you don't 
 > need to add it to /etc/sysctl.conf as well - though it won't hurt, 
 > unless you later wanted to turn it off by updating rc.conf :)

Actually, on a further check that I should have done before posting:

smithi at x200:~ % rcorder /etc/rc.d/* | egrep 'sysctl|routing'
/etc/rc.d/sysctl
/etc/rc.d/routing

So the rc.conf setting will override sysctl.conf anyway.  Still ..

 > Then just a 'service routing restart' will do the trick.  From which:
 > 
 >         if checkyesno gateway_enable; then
 >                 ropts_init inet
 >                 echo -n ' gateway=YES'
 >                 ${SYSCTL} net.inet.ip.forwarding=1 > /dev/null
 >         else
 >                 ${SYSCTL} net.inet.ip.forwarding=0 > /dev/null
 >         fi
 > 
 > cheers, Ian