Boot error: … loading the rules: no IP address found for <dyn.dns.name>...</dyn.dns.name>

iamzam

Hello,

I have a few IPsec tunnels from pfsense 1.2.3 to Linksys WRVS4400N whose (opposite) endpoints are dynamic dns hosts, specified in the webconfigurator gui under VPN:IPsec:Edit Tunnel like this:

Remote Gateway 'host1.dyndns.com'

this is fine and the tunnel is fine, everything works. But at reboot, when loading the /tmp/rules.debug it would hang for a looong time at (console output):

Loading firewall ...

the eventual logs that would return after twenty or thirty minutes were a bunch of entries like this:

php: : New alert found: There were error(s) loading the rules: no IP address found for host1.dyndns.com /tmp/rules.debug:609: could not parse host specification no IP address found for host1.dyndns.com /tmp/rules.debug:610: could not parse host specification no IP address found for host1.dyndns.com /tmp/rules.debug:611: could not parse host specification no IP address found for host1.dyndns.com /tmp/rules.debug:612: could not parse host specification no IP address found for host1.dyndns.com
php: : New alert found: There were error(s) loading the rules: no IP address found for host2.dyndns.com /tmp/rules.debug:613: could not parse host specification no IP address found for host2.dyndns.com /tmp/rules.debug:614: could not parse host specification no IP address found for host2.dyndns.com /tmp/rules.debug:615: could not parse host specification no IP address found for host2.dyndns.com /tmp/rules.debug:616: could not parse host specification no IP address found for host2.dyndns.com

eventually i got it to fully boot by entering the remote ipsec hosts in /var/etc/hosts which seems to get copied verbatim to /etc/hosts sometime on boot.

Obviously this is a silly hack since now these hosts are no longer dynamic and when their ip addresses change i will have to re-enter the new ip address into the hosts file.

The problem seems to be that pfsense has no dns capability before loading /tmp/rules.debug, and in order to have dns capability it needs to load the firewall - chicken and egg problem?

Is there a way around this that I haven't thought of?

thanks for any help