blob: 33f2a2db508863f8fda9ada274035478442abca7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
#
# One firewall, one card. Copy this per card that should be filtered:
# the name, the srv name and the -e argument change together.
#
# fw daemonizes, as Plan 9 file servers do, so what init watches is the
# /srv name and not the pid. The name is there exactly while the
# firewall is filtering: it appears when the server posts it and goes
# when the last of fw exits, whether that is the wire failing, the
# control filesystem going away, or a note.
#
# It has to start before anything dials: a connection made before fw is
# up was never filtered.
#
# If fw dies the machine has no network until it is restarted. That is
# the intended behaviour and not a fault - see FAILURE in fw(8) - so
# restart=always is what you want, not a supervisor that gives up.
#
svc=fw.ether0
exec=/bin/fw
args=-s
args=fw.ether0
args=-m
args=/mnt/fw/ether0
args=-e
args=/net/ether0
#
# The address and gateway, rather than letting fw read them off the
# card. A fw that has died has taken the address with it, so a
# restarted fw has nothing to read; told them, it can restart into the
# bare card it left behind. Without them restart=always brings fw back
# only to fail, and the machine stays off the network - which is the
# safe direction, but not a working one.
#
args=-a
args=10.0.2.15/24
args=-g
args=10.0.2.2
args=/lib/fw/host.ndb
needs=ipconfig
needs=mntfw
ready=srv:fw.ether0
restart=always
enable=no
|
