RC.CONF(5)

📦

version 15.1 · 2 versions

15.1 · freebsd 15.1 (latest)
14.5 · freebsd 14.5

💅 NAME 💅

rc.conf — system configuration information ✨

🦋 DESCRIPTION 🦋

okay so this is rc.conf(5), the File Formats Manual page, and bestie, the file rc.conf is where you keep all the descriptive info about your local host name, the configuration details for any potential network interfaces, and which services should be started up at system initial boot time. In new installations, rc.conf is generally initialized by the system installation utility. No cap.

The whole point of rc.conf is not to run commands or perform system startup actions directly. Instead, it is included by the various generic startup scripts in /etc which conditionalize their internal actions according to the settings found there. It's giving backstage pass, not main character — the scripts do the performing, the config just tells them what vibe to serve 💅.

The /etc/rc.conf file is included from the file /etc/defaults/rc.conf, which specifies the default settings for all the available options. Options need only be specified in /etc/rc.conf when the system administrator wishes to override these defaults. The file /etc/defaults/vendor.conf allows vendors to override FreeBSD defaults. The file /etc/rc.conf.local is used to override settings in /etc/rc.conf for historical reasons. iykyk 🫶.

The sysrc(8) command provides a scripting interface to modify system config files. Slay for automation ✨.

In addition to /etc/rc.conf.local you can also place smaller configuration files for each rc(8) script in the /etc/rc.conf.d directory or ⟨dir⟩/rc.conf.d directories (where ⟨dir⟩ is each entry specified in local_startup, but with any trailing /rc.d stripped), which will be included by the load_rc_config function. For jail configurations you could use the file /etc/rc.conf.d/jail to store jail-specific configuration options. If local_startup contains /usr/local/etc/rc.d and /opt/conf, /usr/local/etc/rc.conf.d/jail and /opt/conf/rc.conf.d/jail will be loaded. If ⟨dir⟩/rc.conf.d/⟨name⟩ is a directory then all of the files in the directory will be loaded. See also the rc_conf_files variable below. Modular configs are literally so iconic 🎀.

Options are set with “name=value” assignments that use sh(1) syntax. The following list provides a name and short description for each variable that can be set in the rc.conf file:

rc_debug (bool) — If set to “YES”, enable output of debug messages from rc scripts. This variable can be helpful in diagnosing mistakes when editing or integrating new scripts. Beware that this produces copious output to the terminal and syslog(3). Like, a lot 💀.
rc_info (bool) — If set to “NO”, disable informational messages from the rc scripts. Informational messages are displayed when a condition that is not serious enough to warrant a warning or an error occurs.
rc_startmsgs (bool) — If set to “YES”, show “Starting foo:” when faststart is used (e.g., at boot time).
early_late_divider (str) — The name of the script that should be used as the delimiter between the “early” and “late” stages of the boot process. The early stage should contain all the services needed to get the disks (local or remote) mounted so that the late stage can include scripts contained in the directories listed in the local_startup variable (see below). Thus, the two likely candidates for this value are mountcritlocal for the typical system, and mountcritremote if the system needs remote file systems mounted to get access to the local_startup directories; for example when /usr/local is NFS mounted. For rc.conf within a jail(8), NETWORKING is likely to be an appropriate value.

Extreme care should be taken when changing this value, and before changing it one should ensure that there are adequate provisions to recover from a failed boot (such as physical contact with the machine, or reliable remote console access). This is not a drill, bestie 😭.

always_force_depends (bool) — Various rc.d scripts use the force_depend function to check whether required services are already running, and to start them if necessary. By default during boot time this check is bypassed if the required service is enabled in /etc/rc.conf[.local]. Setting this option will bypass that check at boot time and always test whether or not the service is actually running. Enabling this option is likely to increase your boot time if services are enabled that utilize the force_depend check. Highkey a tradeoff ⚖️.
⟨name⟩_audit_user (str) — A user name or UID to use as the audit(4) user for the service. Run the chrooted service under this system group. By default, when an unprivileged user restarts a service using a utility such as sudo or doas, the service's audit session will point to the unprivileged user, which may be undesirable. In that case, this variable can be used to override the audit user using setaudit(8).
⟨name⟩_chroot (str) — chroot(8) to this directory before running the service.
⟨name⟩_cpuset (str) — A list of CPUs to run the service on. Passed to cpuset(1) using the -l flag.
⟨name⟩_fib (int) — The setfib(1) value to run the service under.
⟨name⟩_group (str) — Unlike the ⟨name⟩_user setting, this setting has no effect if the service is not chrooted.
⟨name⟩_limits (str) — Resource limits to apply to the service using limits(1). By default, resource limits are based on the login class defined in ⟨name⟩_login_class.
⟨name⟩_login_class (str) — Login class to be used with ⟨name⟩_limits. Defaults to “daemon”.
⟨name⟩_nice (int) — The nice(1) value to run the service under.
⟨name⟩_oomprotect (str) — Use protect(1) to prevent the service from being killed when swap space is exhausted. Use “YES” to protect only the service itself, and “ALL” to protect the service and all its child processes.

Please note that rc scripts which redefine ${argument}_cmd (see rc.subr(8)) such as PostgreSQL will not inherit the OOM killer protection. This variable has no effect on services running within a jail(8).

⟨name⟩_setup (str) — Run the specified setup script right before starting the actual service command. Useful for automatic configuration file generation.
⟨name⟩_umask (int) — Run the service using this umask(1) value.
⟨name⟩_user (str) — Run the service under this user account.
⟨name⟩_svcj (bool) — If set to “YES”, auto-jail the service with inherited filesystem and other jail properties depending on ⟨name⟩_svcj_options.
⟨name⟩_svcj_ipaddrs (str) — A list of IP addresses that the service jail will be permitted to use. If this is not specified, the service jail will be permitted to use all assigned IP addresses if networking is enabled in the jail.
⟨name⟩_svcj_options (str) — A list of jail properties for the service. See “SERVICE JAILS” for a list of valid properties.
apm_enable (bool) — If set to “YES”, enable support for Automatic Power Management with the apm(8) command.
apmd_enable (bool) — Run apmd(8) to handle APM event from userland. This also enables support for APM.
apmd_flags (str) — If apmd_enable is set to “YES”, these are the flags to pass to the apmd(8) daemon.
devd_enable (bool) — Run devd(8) to handle device added, removed or unknown events from the kernel.
ddb_enable (bool) — Run ddb(8) to install ddb(4) scripts at boot time.
ddb_config (str) — Configuration file for ddb(8). Default /etc/ddb.conf.
devmatch_enable (bool) — If set to “NO”, disable auto-loading of kernel modules with devmatch(8).
devmatch_blocklist (str) — A whitespace-separated list of kernel modules to be ignored by devmatch(8). In addition, the kenv(1) devmatch_blocklist is appended to this variable to allow disabling of devmatch(8) loaded modules from the boot loader.
devmatch_blacklist (str) — This variable is deprecated. Use devmatch_blocklist instead. A whitespace-separated list of kernel modules to be ignored by devmatch(8).
kld_list (str) — A whitespace-separated list of kernel modules to load right after the local disks are mounted, without any .ko extension or path.
kldxref_enable (bool) — Set to “NO” by default. Set to “YES” to automatically rebuild linker.hints files with kldxref(8) at boot time.
kldxref_clobber (bool) — Set to “NO” by default. If kldxref_enable is true, setting to “YES” will overwrite existing linker.hints files at boot time. Otherwise, only missing linker.hints files are generated.
kldxref_module_path (str) — Empty by default. A semi-colon (;) delimited list of paths containing kld(4) modules. If empty, the contents of the kern.module_path sysctl(8) are used.
powerd_enable (bool) — If set to “YES”, enable the system power control facility with the powerd(8) daemon.
powerd_flags (str) — If powerd_enable is set to “YES”, these are the flags to pass to the powerd(8) daemon.
svcj_all_enable — Enable auto-jailing of all services which are not explicitly excluded. See “SERVICE JAILS” for more info.
tmpmfs — Controls the creation of a /tmp memory file system. Always happens if set to “YES” and never happens if set to “NO”. If set to anything else, a memory file system is created if /tmp is not writable.
tmpsize — Controls the size of a created /tmp memory file system.
tmpmfs_flags — extra options that get passed to the mdmfs(8) utility when the memory file system for /tmp is created ✨. The default is “-S”, which inhibits the use of softupdates on /tmp so that file system space is freed without delay after file truncation or deletion 👑. Check out mdmfs(8) for the other options you can use in tmpmfs_flags, iykyk.
varmfs — controls the creation of a /var memory file system 💖. It always happens if you set it to “YES” and never happens if it's “NO”. If you set it to literally anything else, a memory file system is created if /var is not writable. fr fr.
varsize — controls the size of a created /var memory file system 📏.
varmfs_flags — extra options passed to mdmfs(8) when the memory file system for /var is created 🌸. Default is “-S”, which inhibits the use of softupdates on /var so file system space is freed without delay after file truncation or deletion 💅. See mdmfs(8) for other options you can use in varmfs_flags.
populate_var — controls the automatic population of the /var file system 🫶. Always happens if set to “YES”, never happens if set to “NO”, and if it's set to anything else a memory file system is created if /var is not writable. Heads up though: this process requires access to certain commands in /usr before /usr is mounted on normal systems ⚠️.
cleanvar_enable — (bool) Clean the /var directory 🧹.
var_run_enable — (bool) Set to "YES" to enable saving of the /var/run directory structure into an mtree file at shutdown and the reload of the /var/run directory structure at boot 🔁.
var_run_autosave — (bool) In some cases it may be undesirable to save /var/run at shutdown 🙈. When set to "NO", /var/run is loaded at reboot but not saved at shutdown. Typically in this scenario ‘service var_run save’ would be performed to save a copy of the /var/run directory structure once, to be reloaded during all subsequent reboots.
var_run_mtree — (str) Where to save the /var/run mtree 📍. The default location is /var/db/mtree/BSD.var-run.mtree.
local_startup — (str) List of directories to search for startup script files 🔍.
script_name_sep — (str) The field separator used to break down the list of startup script files into individual filenames ✂️. Default is a space. You genuinely don't need to change this unless you've got startup scripts with names containing spaces (and if you do, bestie, why 😭).
hostapd_enable — (bool) Set to “YES” to start hostapd(8) at system boot time 📡.
hostname — (str) The fully qualified domain name (FQDN) of this host on the network 🌐. You should almost certainly set this to something meaningful, even if there's no network connection. If dhclient(8) is used to set the hostname via DHCP, this variable should be set to an empty string. Within a jail(8) the hostname is generally already set and this variable may be absent. And if this value remains unset when the system is done booting, your console login will display the default hostname of “Amnesiac” 💀 — like, iconic name, terrible vibe.
nisdomainname — (str) The NIS domain name of this host, or “NO” if NIS is not used.
hostid_enable — (bool) If set to “NO”, disable the generation or saving of the hostid and machine-id files at system boot and shutdown 🚫.
hostid_file — (str) Path to the hostid file, default /etc/hostid 📁.
hostid_uuidgen_flags — (str) Flags passed to uuidgen(1) when generating a software host UUID ✨. This is used only if the system cannot determine a hardware UUID. Set to “-r” by default.
machine_id_file — (str) Path to the machine-id file, default /etc/machine-id 📁.
dhclient_program — (str) Path to the DHCP client program, defaulting to /sbin/dhclient 🔌.
dhclient_flags — (str) Additional flags to pass to the DHCP client program. Peep the dhclient(8) manpage for a description of the command line options available 💅.
dhclient_flags_⟨iface⟩ — additional flags to pass to the DHCP client program running on iface only 🎯. When specified, this variable overrides dhclient_flags.
background_dhclient — (bool) Set to “YES” to start the DHCP client in background ⏩. This can cause trouble with applications depending on a working network, but it will provide a faster startup in many cases. Tradeoffs, bestie.
background_dhclient_⟨iface⟩ — when specified, this variable overrides the background_dhclient variable for interface iface only 🎯.
dhclient_arpwait — (bool) Set to “NO” to stop dhclient(8) from waiting for ARP resolution, so the system boots faster 🏃‍♀️💨. This may be done on networks where the DHCP server is certain to know whether an address is available.
synchronous_dhclient — (bool) Set to “YES” to start dhclient(8) synchronously at startup 🔄. This behavior can be overridden on a per-interface basis by replacing the “DHCP” keyword in the ifconfig_⟨interface⟩ variable with “SYNCDHCP” or “NOSYNCDHCP”.
defaultroute_delay — (int) When set to a positive value, wait up to this long after configuring DHCP interfaces at startup to give the interfaces time to receive a lease ⏳.
firewall_enable — (bool) Set to “YES” to load firewall rules at startup 🔥🛡️. If the kernel was not built with options IPFIREWALL, the ipfw.ko kernel module will be loaded. See also ipfilter_enable.
firewall_script — (str) This variable specifies the full path to the firewall script to run. The default is /etc/rc.firewall 📜.
firewall_type — (str) Names the firewall type from the selection in /etc/rc.firewall, or the file which contains the local firewall ruleset 🗂️. Valid selections from /etc/rc.firewall are:
- open — unrestricted IP access
- closed — all IP services disabled, except via “lo0”
- client — basic protection for a workstation
- workstation — basic protection for a workstation using stateful firewalling
- simple — basic protection for a LAN.

If a filename is specified, the full path must be given 📌.

Most of the predefined rulesets define additional configuration variables. These are documented in /etc/rc.firewall.

firewall_quiet — (bool) Set to “YES” to disable the display of firewall rules on the console during boot 🤫.
firewall_logging — (bool) Set to “YES” to enable firewall event logging 📝. This is equivalent to the IPFIREWALL_VERBOSE kernel option.
firewall_logif — (bool) Set to “YES” to create pseudo interface ipfw0 for logging 🪵. For more details, see the ipfw(8) manual page.
firewall_flags — (str) Flags passed to ipfw(8) if firewall_type specifies a filename 🚩.
firewall_coscripts — (str) List of executables and/or rc scripts to run after firewall starts/stops 🎬. Default is empty.
firewall_nat_enable — (bool) The ipfw(8) equivalent of natd_enable. Setting this to “YES” will automatically load the ipfw(8) NAT kernel module if firewall_enable is also set to “YES” 🔥.
firewall_nat_interface — (str) The ipfw(8) equivalent of natd_interface. This is the name of the public interface or IP address on which kernel NAT should run 🌍.
firewall_nat_flags — (str) Additional configuration parameters for kernel NAT should be placed here 🔧.
firewall_nat64_enable — (bool) Setting this to “YES” will automatically load the ipfw(8) NAT64 kernel module if firewall_enable is also set to “YES” 💫.
firewall_nptv6_enable — (bool) Setting this to “YES” will automatically load the ipfw(8) NPTv6 kernel module if firewall_enable is also set to “YES” 💫.
firewall_pmod_enable — (bool) Setting this to “YES” will automatically load the ipfw(8) pmod kernel module if firewall_enable is also set to “YES” 💫.
dummynet_enable — (bool) Setting this to “YES” will automatically load the dummynet(4) module if firewall_enable is also set to “YES” 💫.
ipfw_netflow_enable — (bool) Setting this to “YES” will enable netflow logging via ng_netflow(4) 📊.

By default an ipfw rule is inserted and all packets are duplicated with the ngtee command and netflow packets are sent to 127.0.0.1 on the netflow port using protocol version 5.

ipfw_netflow_hook — (int) netflow hook name, must be numerical (default 9995) 🪝.
ipfw_netflow_rule — (int) ipfw rule number (default 1000) 🔢.
ipfw_netflow_ip — (str) Destination server ip for receiving netflow data (default 127.0.0.1) 🎯.
ipfw_netflow_port — (int) Destination server port for receiving netflow data (default 9995) 🔌.
ipfw_netflow_version — (int) Do not set for using version 5 of the netflow protocol, set it to 9 for using version 9 9️⃣.
ipfw_netflow_fib — (int) Only match packet in FIB ipfw_netflow_fib (default is undefined meaning all FIBs) 🧭.
natd_program — (str) Path to natd(8) 📁.
natd_enable — (bool) Set to “YES” to enable natd(8) 🌀. firewall_enable must also be set to “YES”, and divert(4) sockets must be enabled in the kernel. If the kernel was not built with options IPDIVERT, the ipdivert.ko kernel module will be loaded.
natd_interface — (str) this is the name of the public interface on which natd(8) should run. it can be given as an interface name or as an IP address. 💖
natd_flags — (str) extra natd(8) flags go here. the -n or -a flag is automatically added with that natd_interface above as its argument. no cap.
ipfilter_enable — (bool) default is "NO". set it to "YES" to enable ipf(8) packet filtering. ✨ typical usage will require putting

ipfilter_enable="YES"
ipnat_enable="YES"
ipmon_enable="YES"
ipfs_enable="YES"

into /etc/rc.conf and editing /etc/ipf.rules and /etc/ipnat.rules appropriately. note that ipfilter_enable and ipnat_enable can be enabled independently. ipmon_enable and ipfs_enable both require at least one of ipfilter_enable and ipnat_enable to be enabled. having

options IPFILTER
options IPFILTER_LOG
options IPFILTER_DEFAULT_BLOCK

in the kernel configuration file is a good idea, too. 🫶

ipfilter_program — (str) path to ipf(8) (default /sbin/ipf). 💅
ipfilter_rules — (str) set to /etc/ipf.rules by default. this variable contains the name of the filter rule definition file. the file is expected to be readable for the ipf(8) command to execute. 🎀
ipfilter_flags — (str) empty by default. this variable contains flags passed to the ipf(8) program.
ipnat_enable — (bool) default is "NO". set it to "YES" to enable ipnat(8) network address translation. see ipfilter_enable for a detailed discussion. 🌸
ipnat_program — (str) path to ipnat(8) (default /sbin/ipnat).
ipnat_rules — (str) set to /etc/ipnat.rules by default. this variable contains the name of the file holding the network address translation definition. this file is expected to be readable for the ipnat(8) command to execute. 💜
ipnat_flags — (str) empty by default. this variable contains flags passed to the ipnat(8) program.
ipmon_enable — (bool) default is "NO". set it to "YES" to enable ipmon(8) monitoring (logging ipf(8) and ipnat(8) events). setting this variable needs setting ipfilter_enable or ipnat_enable too. see ipfilter_enable for a detailed discussion. 👑
ipmon_program — (str) path to ipmon(8) (default /sbin/ipmon).
ipmon_flags — (str) set to "-Ds" by default. this variable contains flags passed to the ipmon(8) program. another typical example would be "-D /var/log/ipflog" to have ipmon(8) log directly to a file bypassing syslogd(8). make sure to adjust /etc/newsyslog.conf in such case like this:

/var/log/ipflog  640  10  100  *  Z  /var/run/ipmon.pid

🦋

ipfs_enable — (bool) default is "NO". set it to "YES" to enable ipfs(8) saving the filter and NAT state tables during shutdown and reloading them during startup again. setting this variable needs setting ipfilter_enable or ipnat_enable to "YES" too. see ipfilter_enable for a detailed discussion.

⚠️ note: if kern_securelevel is set to 3, ipfs_enable cannot be used because the raised securelevel will prevent ipfs(8) from saving the state tables at shutdown time. 😭

ipfs_program — (str) path to ipfs(8) (default /sbin/ipfs).
ipfs_flags — (str) empty by default. this variable contains flags passed to the ipfs(8) program.
pf_enable — (bool) default is "NO". setting this to "YES" enables pf(4) packet filtering. 🔥 typical usage will require putting

pf_enable="YES"

into /etc/rc.conf and editing /etc/pf.conf appropriately. adding

device pf

builds support for pf(4) into the kernel, otherwise the kernel module will be loaded. 🌈

pf_rules — (str) path to pf(4) ruleset configuration file (default /etc/pf.conf).
pf_program — (str) path to pfctl(8) (default /sbin/pfctl).
pf_flags — (str) if pf_enable is set to "YES", these flags are passed to the pfctl(8) program when loading the ruleset. ⭐
pf_fallback_rules_enable — (bool) default is "NO". setting this to "YES" enables loading pf_fallback_rules_file or pf_fallback_rules in case of a problem when loading the ruleset in pf_rules.
pf_fallback_rules_file — (str) path to a pf ruleset to load in case of failure when loading the ruleset in pf_rules (default /etc/pf-fallback.conf).
pf_fallback_rules — (str) a pf ruleset to load in case of failure when loading the ruleset in pf_rules and pf_fallback_rules_file is not found. multiple rules can be set as follows:

pf_fallback_rules="
        block drop log all
        pass in quick on em0"

the default fallback rule is block drop log all. 💀

pflog_enable — (bool) default is "NO". setting this to "YES" enables pflogd(8) which logs packets from the pf(4) packet filter.
pflog_logfile — (str) if pflog_enable is set to "YES" this controls where pflogd(8) stores the logfile (default /var/log/pflog). check /etc/newsyslog.conf to adjust logfile rotation for this. 🙈
pflog_program — (str) path to pflogd(8) (default /sbin/pflogd).
pflog_flags — (str) empty by default. this variable contains additional flags passed to the pflogd(8) program.
pflog_instances — (str) if logging to more than one pflog(4) interface is desired, pflog_instances is set to the list of pflogd(8) instances that should be started at system boot time. if pflog_instances is set, for each whitespace-separated element in the list, ⟨element⟩_dev and ⟨element⟩_logfile elements are assumed to exist. ⟨element⟩_dev must contain the pflog(4) interface to be watched by the named pflogd(8) instance. ⟨element⟩_logfile must contain the name of the logfile that will be used by the pflogd(8) instance. 🍓
ftpproxy_enable — (bool) default is "NO". setting this to "YES" enables ftp-proxy(8) which supports the pf(4) packet filter in translating ftp connections.
ftpproxy_flags — (str) empty by default. this variable contains additional flags passed to the ftp-proxy(8) program.
ftpproxy_instances — (str) empty by default. if multiple instances of ftp-proxy(8) are desired at boot time, ftpproxy_instances should contain a whitespace-separated list of instance names. for each element in the list, a variable named ⟨element⟩_flags should be defined, containing the command-line flags to be passed to the ftp-proxy(8) instance. 🧚
pfsync_enable — (bool) default is "NO". setting this to "YES" enables exposing pf(4) state changes to other hosts over the network by means of pfsync(4). the pfsync_syncdev variable must also be set then.
pfsync_syncdev — (str) empty by default. this variable specifies the name of the network interface pfsync(4) should operate through. it must be set accordingly if pfsync_enable is set to "YES". 🌟
pfsync_syncpeer — (str) empty by default. this variable is optional. by default, state change messages are sent out on the synchronisation interface using IP multicast packets. the protocol is IP protocol 240, PFSYNC, and the multicast group used is 224.0.0.240. when a peer address is specified using the pfsync_syncpeer option, the peer address is used as a destination for the pfsync traffic, and the traffic can then be protected using ipsec(4). see the pfsync(4) manpage for more details about using ipsec(4) with pfsync(4) interfaces. 💫
pfsync_ifconfig — (str) empty by default. this variable can contain additional options to be passed to the ifconfig(8) command used to set up pfsync(4).
tcp_extensions — (bool) default is "YES". setting this to "NO" disables certain TCP options as described by RFC 1323. setting this to "NO" might help remedy such problems with connections as randomly hanging or other weird behavior. some network devices are known to be broken with respect to these options. 😵‍💫
log_in_vain — (int) default is 0. the sysctl(8) variables, net.inet.tcp.log_in_vain and net.inet.udp.log_in_vain, as described in tcp(4) and udp(4), are set to the given value.
tcp_keepalive — (bool) default is "YES". setting to "NO" will disable probing idle TCP connections to verify that the peer is still up and reachable. 🌿
tcp_drop_synfin — (bool) default is "NO". setting to "YES" will cause the kernel to ignore TCP frames that have both the SYN and FIN flags set. this prevents OS fingerprinting, but may break some legitimate applications. 💅
icmp_drop_redirect — (bool) default is "AUTO". this setting will be identical to "YES", if a dynamic routing daemon is enabled, because redirect processing may cause performance issues for large routing tables. if no such service is enabled, this setting behaves like a "NO". setting to "YES" will cause the kernel to ignore ICMP REDIRECT packets. setting to "NO" will cause the kernel to process ICMP REDIRECT packets. refer to icmp(4) for more information. 🦋
icmp_log_redirect — (bool) Defaults to NO. Flip it to YES and the kernel starts logging ICMP REDIRECT packets 💅. But heads up bestie: those log messages are not rate-limited, so this is strictly troubleshooting-networks territory, not a leave-it-on-forever situation 😭. More deets in icmp(4).
icmp_bmcastecho — (bool) Set it to YES and the host responds to broadcast or multicast ICMP ping packets 🫶. Peep icmp(4) for more.
ip_portrange_first — (int) If it's not set to NO, this is the first port in the default portrange ✨. ip(4) has the lore.
ip_portrange_last — (int) Same vibe, other end: if it's not set to NO, this is the last port in the default portrange. Again, ip(4) 🔥.
network_interfaces — (str) Set this to the list of network interfaces you want configured on this host, or AUTO (which is the default) to just grab every current interface 🦋. Setting network_interfaces to anything other than that default is deprecated — like, we're not mad, we're just disappointed 🙈.

So for interfaces where the admin wants to store config but not start them at boot, the move is the NOAUTO keyword in their ifconfig_⟨interface⟩ variables, as described below 👇

An ifconfig_⟨interface⟩ variable is assumed to exist for each value of interface. When an interface name contains any of the characters . - / +, they get translated to _ before lookup 💫. Case in point: the interface em0.102 would be configured using the variable ifconfig_em0_102.

The variable can hold arguments for ifconfig(8), plus the special case-insensitive keywords described below 👑. Those keywords get stripped out before the value is passed to ifconfig(8), and the order of everything else stays preserved. Periodt.

Say you want to assign the IPv4 address 192.0.2.1/24 to the interface em0 — it's giving:

ifconfig_em0="inet 192.0.2.1/24 up"

And if the variable ifconfig_⟨interface⟩_ipv6 is set, then ifconfig_⟨interface⟩ doesn't even need to be set — unless you also want an IPv4 address on that interface, obviously 💖.

You can totally add IP alias entries using ifconfig(8) syntax with the address family keyword, like inet ✨. Assuming the interface in question is em0, it might look something like this:

ifconfig_em0_alias0="inet 127.0.0.253/32"
ifconfig_em0_alias1="inet 127.0.0.254/32"

Oh and you can also configure multiple IP addresses in Classless Inter-Domain Routing (CIDR) address notation, where each address component can be a range — like inet 192.0.2.5-23/24 or inet6 2001:db8:1-f::1/64 🌈. This notation only lets you do the address and prefix length part, not the other address modifiers. And real talk: the maximum number of generated addresses from a range specification is capped at an integer value specified in netif_ipexpand_max in rc.conf, because a tiny little typo can unexpectedly generate a huge number of addresses 😭. The default value is 2048. You can bump it by adding this line into rc.conf:

netif_ipexpand_max="4096"

In the case of 192.0.2.5-23/24, the address 192.0.2.5 gets configured with the prefix length /24 and the addresses 192.0.2.6 to 192.0.2.23 with the non-conflicting prefix length /32, as explained in the ifconfig(8) alias section 💅. Just know that this special CIDR handling is only for inet — not for other address families like inet6 🙅

With the interface in question being em0, an example could look like:

ifconfig_em0_alias2="inet 192.0.2.129/27"
ifconfig_em0_alias3="inet 192.0.2.1-5/28"

and so on 🎀

Ngl, the deprecated ipv4_addrs_⟨interface⟩ variable used to be the one supported for IPv4 CIDR address notation. The ifconfig_⟨interface⟩_alias⟨n⟩ variable replaces it — though ipv4_addrs_⟨interface⟩ is still supported for backward compatibility 🫶.

For each ifconfig_⟨interface⟩_alias⟨n⟩ entry that has an address family keyword, its contents get passed to ifconfig(8). Execution stops at the first unsuccessful access, so if something like this is present:

ifconfig_em0_alias0="inet 127.0.0.251/32"
ifconfig_em0_alias1="inet 127.0.0.252/32"
ifconfig_em0_alias2="inet 127.0.0.253/32"
ifconfig_em0_alias4="inet 127.0.0.254/32"

then bestie, alias4 would not be added, because the search would stop at the missing alias3 entry 💀. Because of this genuinely difficult-to-manage behavior, there's the ifconfig_⟨interface⟩_aliases variable — same functionality as ifconfig_⟨interface⟩_alias⟨n⟩, but you can put all the entries in one variable like this:

ifconfig_em0_aliases="\
        inet 127.0.0.251/32 \
        inet 127.0.0.252/32 \
        inet 127.0.0.253/32 \
        inet 127.0.0.254/32"

It also supports netmask notation for backward compatibility 💜

If the /etc/start_if.⟨interface⟩ file is present, it gets read and executed by the sh(1) interpreter before configuring the interface as specified in the ifconfig_⟨interface⟩ and ifconfig_⟨interface⟩_alias⟨n⟩ variables 🌸

If a vlans_⟨interface⟩ variable is set, a vlan(4) interface gets created for each item in the list, with the vlandev argument set to interface 🦋. Fun little quirk: if a vlan interface's name is a number, then that number is used as the vlan tag and the new vlan interface is named interface.tag. Otherwise, the vlan tag must be specified via a vlan parameter in the create_args_⟨interface⟩ variable 👑

To create a vlan device named em0.101 on em0 with the vlan tag 101 and the optional IPv4 address 192.0.2.1/24:

vlans_em0="101"
ifconfig_em0_101="inet 192.0.2.1/24"

To create a vlan device named myvlan on em0 with the vlan tag 102:

vlans_em0="myvlan"
create_args_myvlan="vlan 102"

If a wlans_⟨interface⟩ variable is set, a wlan(4) interface gets created for each item in the list with the wlandev argument set to interface ✨. Extra wlan cloning arguments can be passed to the ifconfig(8) create command by setting the create_args_⟨interface⟩ variable. And as of FreeBSD 8.0, one or more wlan(4) devices must be created for each wireless device, no cap 💅. Debugging flags for wlan(4) devices as set by wlandebug(8) may be specified with a wlandebug_⟨interface⟩ variable — its contents get passed directly to wlandebug(8) 🔥

If the ifconfig_⟨interface⟩ contains the keyword NOAUTO, then the interface will not be configured at boot or by /etc/pccard_ether when network_interfaces is set to AUTO 🙈

It's possible to bring up an interface with DHCP by adding DHCP to the ifconfig_⟨interface⟩ variable 🎀 For instance, to initialize the em0 device via DHCP, something like this works:

ifconfig_em0="DHCP"

Wanna configure your wireless interface with wpa_supplicant(8) for use with WPA, EAP/LEAP or WEP? Add WPA to the ifconfig_⟨interface⟩ variable 💖

On the other hand, if you want to configure your wireless interface with hostapd(8), add HOSTAP to the ifconfig_⟨interface⟩ variable 👑 hostapd(8) will use the settings from /etc/hostapd-⟨interface⟩.conf

And finally, you can add ifconfig(8) options in this variable, on top of the /etc/start_if.⟨interface⟩ file 🌟 For instance, to configure an ath(4) wireless device in station mode with an address obtained via DHCP, using WPA authentication and 802.11b mode, it's giving:

wlans_ath0="wlan0"
ifconfig_wlan0="DHCP WPA mode 11b"

In addition to the ifconfig_⟨interface⟩ form, there's a fallback variable ifconfig_DEFAULT you can configure 🫶 It gets used for all interfaces that have no ifconfig_⟨interface⟩ variable.

Oh, and you can also rename an interface, like so:

ifconfig_em0_name="net0"
ifconfig_net0="inet 192.0.2.1/24"

ipv6_enable — (bool) This variable is deprecated, bestie 😭 Use ifconfig_⟨interface⟩_ipv6 and ipv6_activate_all_interfaces if necessary.

If the variable is YES, then inet6 accept_rtadv is added to all of ifconfig_⟨interface⟩_ipv6, and the ipv6_activate_all_interfaces variable is defined as YES ✨

ipv6_prefer — (bool) Also deprecated 💀 Use ip6addrctl_policy instead.

If the variable is YES, the default address selection policy table set by ip6addrctl(8) will be IPv6-preferred 🦋

If the variable is NO, the default address selection policy table set by ip6addrctl(8) will be IPv4-preferred 🌸

ipv6_activate_all_interfaces — (bool) This one controls initial configuration on IPv6-capable interfaces that have no corresponding ifconfig_⟨interface⟩_ipv6 variable 👑 Note that it is not always necessary to set this variable to YES to use IPv6 functionality on FreeBSD. In most cases, just configuring ifconfig_⟨interface⟩_ipv6 variables works 💅

So like, if the variable is "NO", every single interface that doesn't have a matching ifconfig_⟨interface⟩_ipv6 variable gets marked "IFDISABLED" the moment it's created 💅 — and that means all IPv6 functionality on that interface is completely off, like fully disabled to enforce a security policy. If it's set to "YES", the flag gets cleared on all of the interfaces instead.

In most cases you literally just define an ifconfig_⟨interface⟩_ipv6 for an IPv6-capable interface and that's enough, slay. But — and this is the plot twist — if an interface gets added dynamically (think tunneling protocols like PPP), it's often super hard to define the variable in advance 🙈. In that case you can disable configuring the "IFDISABLED" flag by setting this variable to "YES".

For more deets on the "IFDISABLED" flag and the keywords "inet6 ifdisabled", go check ifconfig(8).

Default is "NO".

ipv6_privacy (bool) — if this one's "YES", privacy addresses get generated for each IPv6 interface, exactly as described in RFC 4941 ✨
ipv6_network_interfaces (str) — this is basically the IPv6 equivalent of network_interfaces. tbh you normally don't need to configure this one manually at all.
ipv6_cpe_wanif (str) — okay so if you set this to an interface name, the ifconfig(8) options "inet6 -no_radr accept_rtadv" get added to the specified interface automatically before ifconfig_⟨interface⟩_ipv6 gets evaluated, and two sysctl(8) variables — net.inet6.ip6.rfc6204w3 and net.inet6.ip6.no_radr — get set to 1.

What that means: the specified interface will accept ICMPv6 Router Advertisement messages on that link and add the discovered routers into the Default Router List 🛰️. The other interfaces can still accept RA messages if the "inet6 accept_rtadv" option is specified, but adding routes into the Default Router List is disabled by the "inet6 no_radr" option by default. See ifconfig(8) for the full story.

Heads up though: ICMPv6 Router Advertisement messages will be accepted even when net.inet6.ip6.forwarding is 1 (yes, packet forwarding is enabled) when net.inet6.ip6.rfc6204w3 is set to 1.

Default is "NO".

ifconfig_⟨interface⟩_descr (str) — assigns an arbitrary description to an interface 🏷️. The sysctl(8) variable net.ifdescr_maxlen limits how long it can be. This static setting may get overridden by commands started with dynamic interface configuration utilities, like dhclient(8) hooks. You can see the description with the ifconfig(8) command, and it may be exported with the bsnmpd(1) daemon using its MIB-2 module.
ifconfig_⟨interface⟩_ipv6 (str) — IPv6 functionality on an interface should be configured through ifconfig_⟨interface⟩_ipv6, not by setting ifconfig parameters inside ifconfig_⟨interface⟩. Important: if this variable is empty, all IPv6 configurations on the specified interface done by other variables — like ipv6_prefix_⟨interface⟩ — will be ignored 💀.

Aliases should be set by ifconfig_⟨interface⟩_alias⟨n⟩ with the "inet6" keyword. For example:

ifconfig_em0_ipv6="inet6 2001:db8:1::1 prefixlen 64"
ifconfig_em0_alias0="inet6 2001:db8:2::1 prefixlen 64"

Interfaces that have an "inet6 accept_rtadv" keyword in the ifconfig_⟨interface⟩_ipv6 setting get automatically configured by SLAAC (StateLess Address AutoConfiguration), as described in RFC 4862 ✨.

Note that a link-local address will be automatically configured in addition to the configured global-scope addresses, because the IPv6 specifications require it on each link. The address is calculated from the MAC address using an algorithm defined in RFC 4862, Section 5.3 🧮.

If you only need a link-local address on the interface, this config does the trick:

ifconfig_em0_ipv6="inet6 auto_linklocal"

You can also configure a link-local address manually — which is genuinely useful for the default router address of an IPv6 router, so it doesn't change when the network interface card gets replaced 🔁. Like this:

ifconfig_em0_ipv6="inet6 fe80::1 prefixlen 64"

ipv6_prefix_⟨interface⟩ (str) — if one or more prefixes are defined in ipv6_prefix_⟨interface⟩, addresses based on each prefix and the EUI-64 interface index get configured on that interface 🌈. But remember: this variable is ignored when ifconfig_⟨interface⟩_ipv6 is empty.

So for example, this configuration:

ipv6_prefix_em0="2001:db8:1:0 2001:db8:2:0"

is equivalent to this:

ifconfig_em0_alias0="inet6 2001:db8:1:: eui64 prefixlen 64"
ifconfig_em0_alias1="inet6 2001:db8:1:: prefixlen 64 anycast"
ifconfig_em0_alias2="inet6 2001:db8:2:: eui64 prefixlen 64"
ifconfig_em0_alias3="inet6 2001:db8:2:: prefixlen 64 anycast"

Those Subnet-Router anycast addresses only get added when ipv6_gateway_enable is YES, iykyk.

ipv6_default_interface (str) — if it's not set to "NO", this is the default output interface for scoped addresses. It only works with ipv6_gateway_enable="NO".
ip6addrctl_enable (bool) — this variable enables configuring the default address selection policy table (RFC 3484) 👑. The table itself can be specified in another variable, ip6addrctl_policy. For ip6addrctl_policy you can specify these keywords: "ipv4_prefer", "ipv6_prefer", or "AUTO".

If "ipv4_prefer" or "ipv6_prefer" is specified, ip6addrctl(8) installs a pre-defined policy table described in Section 10.3 (IPv4-preferred) or 2.1 (IPv6-preferred) of RFC 3484.

If "AUTO" is specified, it first tries to read the file /etc/ip6addrctl.conf. If that file is found, ip6addrctl(8) reads and installs it 📥. If it's not found, a policy gets set automatically according to the ipv6_activate_all_interfaces variable — if that one's set to "YES" you get the IPv6-preferred one, otherwise IPv4-preferred.

The default value of ip6addrctl_enable and ip6addrctl_policy are "YES" and "AUTO", respectively.

cloned_interfaces (str) — set this to the list of clonable network interfaces to create on this host 🫶. You can pass further cloning arguments to the ifconfig(8) create command for each interface by setting the create_args_⟨interface⟩ variable. If an interface name is specified with the ":sticky" keyword, the interface won't be destroyed even when the rc.d/netif script is invoked with the "stop" argument — super handy when you're reconfiguring an interface without destroying it. Pro tip: entries in cloned_interfaces are automatically appended to network_interfaces for configuration.
cloned_interfaces_sticky (bool) — globally enables the functionality of the ":sticky" keyword in cloned_interfaces for all interfaces. Default value is "NO". And even if you set this to "YES", the ":nosticky" keyword can override it on a per-interface basis 💅.
gif_interfaces — set to the list of gif(4) tunnel interfaces to configure on this host. A gifconfig_⟨interface⟩ variable is assumed to exist for each value of interface. The value of this variable configures the link layer of the tunnel using the tunnel option to ifconfig(8) 🚇. On top of that, this option makes sure each listed interface is created via the create option to ifconfig(8) before it even tries to configure it.

For example, configure two gif(4) interfaces with:

gif_interfaces="gif0 gif1"
gifconfig_gif0="100.64.0.1 100.64.0.2"
ifconfig_gif0="inet 10.0.0.1/30 10.0.0.2"
gifconfig_gif1="inet6 2a00::1 2a01::1"
ifconfig_gif1="inet 10.1.0.1/30 10.1.0.2"

ppp_enable (bool) — if set to "YES", run the ppp(8) daemon 📞.
ppp_profile (str) — the name of the profile to use from /etc/ppp/ppp.conf. Also used for per-profile overrides of ppp_mode and ppp_nat, plus ppp_⟨profile⟩_unit. And when the profile name contains any of the characters ".-/+ " — okay, specifically the characters .-/+ — they get translated to _ for the purposes of the override variable names 🎀.
ppp_mode (str) — mode in which to run the ppp(8) daemon.
ppp_⟨profile⟩_mode (str) — overrides the global ppp_mode for profile. Accepted modes are "auto", "ddial", "direct" and "dedicated". See the manual for a full description 📖.
ppp_nat (bool) — if set to "YES", enables network address translation. Used in conjunction with gateway_enable, it lets hosts on private network addresses access the Internet using this host as a network address translating router 🌐. Default is "YES".
ppp_⟨profile⟩_nat (str) — overrides the global ppp_nat for profile.
ppp_⟨profile⟩_unit (int) — sets the unit number to be used for this profile. See the manual description of -unitN for details.
ppp_user (str) — the name of the user under which ppp(8) should be started. By default, ppp(8) is started as "root".
rc_conf_files (str) — this option specifies a list of files that will override the settings in /etc/defaults/rc.conf 🗂️. The files are read in the order in which they're specified, and you should include the full path to each file. By default the files specified are /etc/rc.conf and /etc/rc.conf.local.
zfs_enable (bool) — set this to "YES" and /etc/rc.d/zfs will try to automatically mount your ZFS file systems and initialize ZFS volumes (ZVOLs) at boot 💅 lowkey magical.
zpool_reguid (str) — a space-separated list of ZFS pool names that should get brand-new pool GUIDs assigned on first boot. Bestie, this is your moment if you're using a ZFS pool copied from a template — like a virtual machine image 🫶.
zpool_upgrade (str) — a space-separated list of ZFS pool names whose version should be upgraded on first boot. Slay for when you've got a ZFS pool generated by the makefs(8) utility ✨.
gptboot_enable (bool) — if "YES", /etc/rc.d/gptboot will log whether the system successfully booted (or… didn't 😭) from a GPT partition that had the bootonce attribute set using the gpart(8) utility.
geli_devices (str) — the list of devices to automatically attach on boot. Heads up though: .eli devices from /etc/fstab get automatically appended to this list, so no need to double up 💖.
geli_groups (str) — list of groups containing devices to auto-attach on boot with the same keyfiles and passphrase. It must be accompanied by a corresponding geli_⟨group⟩_devices variable — that's the vibe check, don't skip it 👑
geli_tries (int) — how many times the user gets asked for the pass-phrase. If it's empty, it's taken from the kern.geom.eli.tries sysctl variable 🎀.
geli_default_flags (str) — the default flags geli(8) uses when configuring disk encryption. You can also set flags per device by defining the geli_⟨device⟩_flags variable, and per group by defining the geli_⟨group⟩_flags variable — customizable icon behavior fr fr 🦋.
geli_autodetach (str) — says whether GELI devices should be marked for detach on last close after file systems are mounted. Default is "YES". You can change it per device by defining the geli_⟨device⟩_autodetach variable 🌸.
root_rw_mount (bool) — set to "YES" by default. After the file systems are checked at boot time, the root file system is remounted read-write if this is "YES". Diskless systems that mount their root file system from a read-only remote NFS share should set this to "NO" in their rc.conf — not me giving you the exact escape hatch 😌
fsck_y_enable (bool) — if "YES", fsck(8) will be run with the -y flag if the initial preen of the file systems fails. It's giving "just say yes to everything" energy 💀.
background_fsck (bool) — if "NO", the system will not attempt to run fsck(8) in the background where possible.
background_fsck_delay (int) — the amount of time in seconds to sleep before starting a background fsck(8). It defaults to sixty seconds so big apps like the X server can start before disk I/O bandwidth gets monopolized by fsck(8). If you set it to a negative number, the background file system check will be delayed indefinitely so the administrator can run it at a more convenient time 🔥 for example, run it from cron(8) by adding a line like

   0 4 * * * root /etc/rc.d/bgfsck forcestart

to /etc/crontab 🎀.

netfs_types (str) — list of file system types that are network-based. This list should generally not be modified by end users — use extra_netfs_types instead, bestie, that's what it's there for 💅.
extra_netfs_types (str) — if set to something other than "NO" (the default), this variable extends the list of file system types for which automatic mounting at startup by rc(8) should be delayed until the network is initialized. It should contain a whitespace-separated list of network file system descriptor pairs, each consisting of a file system type as passed to mount(8) and a human-readable, one-word description, joined with a colon (':'). Extending the default list this way is only necessary when third party file system types are used 🌈.
syslogd_enable (bool) — if "YES", run the syslogd(8) daemon. Note, the syslogd_oomprotect variable is set to "YES" by default in /etc/defaults/rc.conf 🫶.
syslogd_program (str) — path to syslogd(8) (default /usr/sbin/syslogd).
syslogd_flags (str) — if syslogd_enable is set to "YES", these are the flags to pass to syslogd(8) ✨.
inetd_enable (bool) — if "YES", run the inetd(8) daemon.
inetd_program (str) — path to inetd(8) (default /usr/sbin/inetd).
inetd_flags (str) — if inetd_enable is set to "YES", these are the flags to pass to inetd(8).
hastd_enable (bool) — if "YES", run the hastd(8) daemon.
hastd_program (str) — path to hastd(8) (default /sbin/hastd).
hastd_flags (str) — if hastd_enable is set to "YES", these are the flags to pass to hastd(8) 🦋.
local_unbound_enable (bool) — if "YES", run the unbound(8) daemon as a local caching DNS resolver. Note, the local_unbound_oomprotect variable is set to "YES" by default in /etc/defaults/rc.conf 💖.
nscd_enable (bool) — set to "YES" to start the nscd(8) caching daemon for the nsswitch subsystem.
nscd_flags (str) — if nscd_enable is set to "YES", these flags are passed to nscd(8).
kdc_enable (bool) — set to "YES" to start a Kerberos 5 authentication server at boot time 👑.
kdc_program (str) — if kdc_enable is set to "YES", this is the path to the Kerberos 5 Authentication Server.
kdc_flags (str) — empty by default. This variable contains additional flags to be passed to the Kerberos 5 authentication server.
kadmind_enable (bool) — set to "YES" to start kadmind(8), the Kerberos 5 Administration Daemon; set to "NO" on a slave server 🌸.
kadmind_program (str) — if kadmind_enable is set to "YES", this is the path to the Kerberos 5 Administration Daemon.
kpasswdd_enable (bool) — set to "YES" to start kpasswdd(8), the Kerberos 5 Password-Changing Daemon; set to "NO" on a slave server 🔐.
kpasswdd_program (str) — if kpasswdd_enable is set to "YES", this is the path to the Kerberos 5 Password-Changing Daemon.
kfd_enable (bool) — set to "YES" to start kfd(8), the Kerberos 5 ticket forwarding daemon, at boot time 🎫.
kfd_program (str) — path to kfd(8) (default /usr/libexec/kfd).
rwhod_enable (bool) — if "YES", run the rwhod(8) daemon at boot time.
rwhod_flags (str) — if rwhod_enable is set to "YES", these are the flags to pass to it ✨.
update_motd (bool) — if "YES", /var/run/motd will be updated at boot time to reflect the kernel release being run. If "NO", /var/run/motd will not be updated — the way that it just… doesn't touch it 😭.
nfs_client_enable (bool) — if "YES", run the NFS client daemons at boot time.
nfs_access_cache (int) — if nfs_client_enable is set to "YES", this can be set to "0" to disable NFS ACCESS RPC caching, or to the number of seconds for which NFS ACCESS results should be cached. A value of 2-10 seconds will substantially reduce network traffic for many NFS operations 🔥.
nfs_server_enable (bool) — if "YES", run the NFS server daemons at boot time.
nfs_server_flags (str) — if nfs_server_enable is set to "YES", these are the flags to pass to the nfsd(8) daemon.
nfsv4_server_enable (bool) — if nfs_server_enable is set to "YES" and nfsv4_server_enable is set to "YES", enable the server for NFSv4 as well as NFSv2 and NFSv3 🌈.
nfsv4_server_only (bool) — if nfs_server_enable is set to "YES" and nfsv4_server_only is set to "YES", enable the NFS server for NFSv4 only — no crumbs for the old versions, periodt 💅.
nfs_server_maxio (int) — value to set vfs.nfsd.srvmaxio to, which is the maximum I/O size for the NFS server 🎀.
tlsclntd_enable (bool) — if "YES", run the rpc.tlsclntd(8) daemon, which is needed for NFS-over-TLS NFS mounts 🔐.
tlsservd_enable (bool) — if "YES", run the rpc.tlsservd(8) daemon, which is needed for the nfsd(8) to support NFS-over-TLS NFS mounts 🦋.
nfsuserd_enable (bool) — if nfsuserd_enable is set to "YES", run the nfsuserd daemon, which is needed for NFSv4 in order to map between user/group names vs uid/gid numbers. And if nfsv4_server_enable is set to "YES", this will be forced enabled — not optional, bestie 👑.
nfsuserd_flags (str) — if nfsuserd_enable is set to "YES", these are the flags to pass to the nfsuserd(8) daemon.
nfscbd_enable (bool) — if nfscbd_enable is set to "YES", run the nfscbd daemon, which enables callbacks/delegations for the NFSv4 client ✨.
nfscbd_flags (str) — if nfscbd_enable is set to "YES", these are the flags to pass to the nfscbd(8) daemon.
mountd_enable (bool) — if set to "YES", and no nfs_server_enable is set, start mountd(8), but not the nfsd(8) daemon. It is commonly needed to run CFS without real NFS used 💖.
mountd_flags (str) — if mountd_enable is set to "YES", these are the flags to pass to the mountd(8) daemon.
weak_mountd_authentication (bool) — if "YES", allow services like PCNFSD to make non-privileged mount requests 🙈.
nfs_reserved_port_only (bool) — if "YES", provide NFS services only on a secure port 🔒.
nfs_bufpackets — (int) set this to a number and it tells the NFS client how many packets' worth of socket buffer space to reserve, bestie. Kernel default is usually 4. Bumping it up may help on gigabit networks 💨. Minimum is 2, maximum is 64.
rpc_lockd_enable — (bool) set to "YES" and you're also running an NFS server or client? Then rpc.lockd(8) gets run at boot time 🎀.
rpc_lockd_flags — (str) if rpc_lockd_enable is "YES", these are the flags handed to the rpc.lockd(8) daemon.
rpc_statd_enable — (bool) set to "YES" and you're also an NFS server or client → rpc.statd(8) runs at boot time ✨.
rpc_statd_flags — (str) if rpc_statd_enable is "YES", these are the flags passed to the rpc.statd(8) daemon.
rpcbind_program — (str) path to rpcbind(8) (default /usr/sbin/rpcbind) 🛰️.
rpcbind_enable — (bool) set to "YES" and the rpcbind(8) service runs at boot time.
rpcbind_flags — (str) if rpcbind_enable is "YES", these are the flags passed to the rpcbind(8) daemon.

pppoed_enable — (bool) set to "YES" and pppoed(8) runs at boot time, serving up PPP over Ethernet like the icon it is 👑.
pppoed_⟨provider⟩ — (str) pppoed(8) listens for requests to this provider and ultimately runs ppp(8) with a system argument of that same name.
pppoed_flags — (str) extra flags to pass to pppoed(8) 🦋.
pppoed_interface — (str) the network interface pppoed(8) runs on. This one is mandatory when pppoed_enable is "YES" — no interface, no vibes 💅.

ntpdate_enable — (bool) set to "YES" and ntpdate(8) runs at system startup. This command is meant to sync the system clock exactly once from some standard reference ⏰.

Heads up: using the ntpd_sync_on_start variable is the preferred alternative to the ntpdate(8) utility, because ntpdate(8) is being retired from the NTP distribution 😭.

ntpdate_config — (str) config file for ntpdate(8). Default /etc/ntp.conf.
ntpdate_hosts — (str) a whitespace-separated list of NTP servers to sync with at startup. Default behaviour is to use the servers listed in ntpdate_config, but only if that file actually exists.
ntpdate_program — (str) path to ntpdate(8) (default /usr/sbin/ntpdate).
ntpdate_flags — (str) if ntpdate_enable is "YES", these are the flags passed to the ntpdate(8) command (typically a hostname).
ntpd_enable — (bool) set to "YES" and the ntpd(8) command runs at boot time 🌸.
ntpd_program — (str) path to ntpd(8) (default /usr/sbin/ntpd).
ntpd_config — (str) path to the ntpd(8) configuration file. Default /etc/ntp.conf.
ntpd_flags — (str) if ntpd_enable is "YES", these are the flags passed to the ntpd(8) daemon.
ntpd_sync_on_start — (bool) set to "YES" and ntpd(8) runs with the -g flag, which syncs the system's clock on startup ✨. Peep ntpd(8) for more on what -g does. This is the preferred alternative to using ntpdate(8) or setting the ntpdate_enable variable. Main character energy fr fr.

nis_client_enable — (bool) set to "YES" and the ypbind(8) service runs at system boot time.
nis_client_flags — (str) if nis_client_enable is "YES", these are the flags passed to the ypbind(8) service.
nis_ypldap_enable — (bool) set to "YES" and the ypldap(8) daemon runs at system boot time 🧚.
nis_ypldap_flags — (str) if nis.ypldap_enable is "YES", these are the flags passed to the ypldap(8) daemon.
nis_ypset_enable — (bool) set to "YES" and the ypset(8) daemon runs at system boot time.
nis_ypset_flags — (str) if nis_ypset_enable is "YES", these are the flags passed to the ypset(8) daemon.
nis_server_enable — (bool) set to "YES" and the ypserv(8) daemon runs at system boot time.
nis_server_flags — (str) if nis_server_enable is "YES", these are the flags passed to the ypserv(8) daemon.
nis_ypxfrd_enable — (bool) set to "YES" and the rpc.ypxfrd(8) daemon runs at system boot time 🌈.
nis_ypxfrd_flags — (str) if nis_ypxfrd_enable is "YES", these are the flags passed to the rpc.ypxfrd(8) daemon.
nis_yppasswdd_enable — (bool) set to "YES" and the rpc.yppasswdd(8) daemon runs at system boot time.
nis_yppasswdd_flags — (str) if nis_yppasswdd_enable is "YES", these are the flags passed to the rpc.yppasswdd(8) daemon.
rpc_ypupdated_enable — (bool) set to "YES" and the rpc.ypupdated daemon runs at system boot time ⭐.

bsnmpd_enable — (bool) set to "YES" and the bsnmpd(1) daemon runs at system boot time. Bestie — please make sure you actually understand the security implications of running an SNMP daemon on your host before you flip this one 🚨.
bsnmpd_flags — (str) if bsnmpd_enable is "YES", these are the flags passed to the bsnmpd(1) daemon.

defaultrouter — (str) if it's not set to "NO", a default route gets created to this host name or IP address. Use an IP address if this router is also required to get to the name server!! 🫶
defaultrouter_fibN — (str) if it's not set to "NO", a default route gets created in FIB N to this host name or IP address.
ipv6_defaultrouter — (str) the IPv6 equivalent of defaultrouter 💜.
ipv6_defaultrouter_fibN — (str) the IPv6 equivalent of defaultrouter_fibN.

static_arp_pairs — (str) set this to the list of static ARP pairs to be added at system boot time. For each whitespace-separated element in the value, a static_arp_⟨element⟩ variable is assumed to exist, and its contents get passed to an "arp -S" operation later. Like so:

static_arp_pairs="gw"
static_arp_gw="192.168.1.1 00:01:02:03:04:05"

static_ndp_pairs — (str) set this to the list of static NDP pairs to be added at system boot time. For each whitespace-separated element in the value, a static_ndp_⟨element⟩ variable is assumed to exist, and its contents get passed to an "ndp -s" operation later. Example time:

static_ndp_pairs="gw"
static_ndp_gw="2001:db8:3::1 00:01:02:03:04:05"

static_routes — (str) set this to the list of static routes to be added at system boot time. If it's not set to "NO", then for each whitespace-separated element in the value, a route_⟨element⟩ variable is assumed to exist, and its contents get passed to a "route add" operation later. For example:

static_routes="ext mcast:gif0 gif0local:gif0"
route_ext="-net 10.0.0.0/24 -gateway 192.168.0.1"
route_mcast="-net 224.0.0.0/4 -iface gif0"
route_gif0local="-host 169.254.1.1 -iface lo0"

When an element is in the form name:ifname, the route is specific to the interface ifname 💅.

ipv6_static_routes — (str) the IPv6 equivalent of static_routes. If it's not set to "NO", then for each whitespace-separated element in the value, an ipv6_route_⟨element⟩ variable is assumed to exist, and its contents get passed to a "route add -inet6" operation later.

gateway_enable — (bool) set to "YES" and your host is configured to act as an IP router, e.g. forwarding packets between interfaces 🛣️.
ipv6_gateway_enable — (bool) the IPv6 equivalent of gateway_enable.
routed_enable — (bool) set to "YES" and a routing daemon of some sort runs, based on the settings of routed_program and routed_flags.
route6d_enable — (bool) the IPv6 equivalent of routed_enable. Set to "YES" and a routing daemon of some sort runs, based on the settings of route6d_program and route6d_flags ✨.
routed_program — (str) if routed_enable is "YES", this is the name of the routing daemon to use. Default is routed(8).
route6d_program — (str) the IPv6 equivalent of routed_program. Default is route6d(8).
routed_flags — (str) if routed_enable is "YES", these are the flags passed to the routing daemon.
route6d_flags — (str) the IPv6 equivalent of routed_flags.

rtadvd_enable — (bool) set to "YES" and the rtadvd(8) daemon runs at boot time. The rtadvd(8) utility sends ICMPv6 Router Advertisement messages to the interfaces specified in rtadvd_interfaces.

Okay so this one should only be enabled with great care 🫣. You may want to fine-tune rtadvd.conf(5).

rtadvd_flags — (str) if rtadvd_enable is "YES", these are the flags passed to rtadvd(8).
rtadvd_interfaces — (str) if rtadvd_enable is "YES", this is the list of interfaces to use.

arpproxy_all — (bool) set to "YES" to enable global proxy ARP 🌸.
forward_sourceroute — (bool) set to "YES" and gateway_enable is also "YES" → source-routed packets get forwarded.
accept_sourceroute — (bool) set to "YES" and the system will accept source-routed packets directed at it.
rarpd_enable — (bool) set to "YES" and the rarpd(8) daemon runs at system boot time 🎀.
rarpd_flags — (str) if rarpd_enable is "YES", these are the flags passed to the rarpd(8) daemon.
bootparamd_enable — (bool) set to "YES" and the bootparamd(8) daemon runs at system boot time 🌟.
bootparamd_flags — str. If bootparamd_enable is "YES", these are the flags that get passed to the bootparamd(8) daemon. 🎀
stf_interface_ipv4addr — str. If this isn't set to "NO", it's the local IPv4 address for 6to4 (that's IPv6 over IPv4 tunneling interface, iykyk). Set this entry to enable the 6to4 interface. ✨
stf_interface_ipv4plen — int. Prefix length for 6to4 IPv4 addresses, used to limit the peer address range. An effective value is 0-31.
stf_interface_ipv6_ifid — str. IPv6 interface ID for stf(4). This can be set to "AUTO". 🦋
stf_interface_ipv6_slaid — str. IPv6 Site Level Aggregator for stf(4).
ipv6_ipv4mapping — bool. Set it to "YES" and this enables IPv4 mapped IPv6 address communication (like ::ffff:a.b.c.d). lowkey iconic 💅
rtsold_enable — bool. Set to "YES" to enable the rtsold(8) daemon so it sends ICMPv6 Router Solicitation messages. 📡
rtsold_flags — str. If rtsold_enable is set to "YES", these are the flags passed to rtsold(8).
rtsol_flags — str. For interfaces configured with the "inet6 accept_rtadv" keyword, these are the flags passed to rtsol(8).

⚠️ heads up bestie: rtsold_enable is mutually exclusive to rtsol_flags; rtsold_enable takes precedence. periodt.

keybell — str. The keyboard bell sound 🎵. Set to "normal", "visual", "off", or "NO" if the default behavior is what you want. For the details, go read the kbdcontrol(1) manpage.
keyboard — str. If set to a non-null string, the virtual console's keyboard input is set to this device. ⌨️
keymap — str. If set to "NO", no keymap is installed; otherwise the value is used to install the keymap file found in /usr/share/syscons/keymaps/value.kbd (if you're using syscons(4)) or /usr/share/vt/keymaps/value.kbd (if you're using vt(4)). 🗺️
keyrate — str. The keyboard repeat speed. Set to "slow", "normal", "fast", or "NO" if the default behavior is what you want.
keychange — str. If not set to "NO", it attempts to program the function keys with the value. The value should be a single string of the form: "funkey_number new_value [funkey_number new_value ...]". 🎹
cursor — str. Can be set to "normal", "blink", "destructive", or "NO" to set the cursor behavior explicitly, or to choose the default behavior.
scrnmap — str. If set to "NO", no screen map is installed; otherwise the value is used to install the screen map file in /usr/share/syscons/scrnmaps/value. 🫶 This parameter is ignored when using vt(4) as the console driver.
font8x16 — str. If set to "NO", the default 8x16 font value is used for screen size requests; otherwise the value in /usr/share/syscons/fonts/value or /usr/share/vt/fonts/value is used (depending on the console driver being used). 🔤
font8x14 — str. If set to "NO", the default 8x14 font value is used for screen size requests; otherwise the value in /usr/share/syscons/fonts/value or /usr/share/vt/fonts/value is used (depending on the console driver being used).
font8x8 — str. If set to "NO", the default 8x8 font value is used for screen size requests; otherwise the value in /usr/share/syscons/fonts/value or /usr/share/vt/fonts/value is used (depending on the console driver being used).
blanktime — int. If set to "NO", the default screen blanking interval is used; otherwise it's set to value seconds. 😴
saver — str. If not set to "NO", this is the actual screen saver to use (blank, snake, daemon, etc). 🐍
moused_nondefault_enable — str. If set to "NO", the mouse device specified on the command line is not automatically treated as enabled by the /etc/rc.d/moused script. Having this variable set to "YES" allows a usb(4) mouse, for example, to be enabled as soon as it's plugged in. 🖱️✨
moused_enable — str. If set to "YES", the moused(8) daemon is started, doing cut/paste selection on the console.
moused_type — str. This is the protocol type of the mouse connected to this host. This variable must be set if moused_enable is set to "YES", but it defaults to "auto" since the moused(8) daemon is able to detect the appropriate mouse type automatically in many cases. Set this variable to one from the following list if the automatic detection fails. 🐭

If the mouse is attached to the PS/2 mouse port, choose "auto" or "ps/2", regardless of the brand and model of the mouse. Likewise, if the mouse is attached to the bus mouse port, choose "auto" or "busmouse". All other protocols are for serial mice and will not work with the PS/2 and bus mice. If this is a USB mouse, "auto" is the only protocol type which will work.

microsoft — Microsoft mouse (serial)
intellimouse — Microsoft IntelliMouse (serial)
mousesystems — Mouse systems Corp. mouse (serial)
mmseries — MM Series mouse (serial)
logitech — Logitech mouse (serial)
busmouse — A bus mouse
mouseman — Logitech MouseMan and TrackMan (serial)
glidepoint — ALPS GlidePoint (serial)
thinkingmouse — Kensington ThinkingMouse (serial)
ps/2 — PS/2 mouse
mmhittab — MM HitTablet (serial)
x10mouseremote — X10 MouseRemote (serial)
versapad — Interlink VersaPad (serial)

Even if the mouse is not in the above list, it may be compatible with one in the list. Refer to the manual page for moused(8) for compatibility info. 🧚

It should also be noted that while this is enabled, any other client of the mouse (such as an X server) should access the mouse through the virtual mouse device, /dev/sysmouse, and configure it as a "sysmouse" type mouse, since all mouse data is converted to this single canonical format when using moused(8). If the client program does not support the "sysmouse" type, specify the "mousesystems" type. It's the second preferred type. 💖

moused_port — str. If moused_enable is set to "YES", this is the actual port the mouse is on. It might be /dev/cuau0 for a COM1 serial mouse, or /dev/psm0 for a PS/2 mouse, for example.
moused_flags — str. If moused_flags is set, its value is used as an additional set of flags to pass to the moused(8) daemon.
moused_XXX_flags — When moused_nondefault_enable is enabled, and a moused(8) daemon is started for a non-default port, the moused_XXX_flags set of options has precedence over and replaces the default moused_flags (where XXX is the name of the non-default port, i.e., ums0). By setting moused_XXX_flags it's possible to set up a different set of default flags for each moused(8) instance. For example, you can use "-3" for the default moused_flags to make your laptop's touchpad more comfortable to use, but an empty set of options for moused_ums0_flags when your usb(4) mouse has three or more buttons. 🖱️👑
mousechar_start — int. If set to "NO", the default mouse cursor character range 0xd0-0xd3 is used; otherwise the range start is set to value character, see vidcontrol(1). Use this if the default range is occupied in the language code table.
allscreens_flags — str. If set, vidcontrol(1) is run with these options for each of the virtual terminals (/dev/ttyv*). For example, "-m on" will enable the mouse pointer on all virtual terminals if moused_enable is set to "YES". 🌈
allscreens_kbdflags — str. If set, kbdcontrol(1) is run with these options for each of the virtual terminals (/dev/ttyv*). For example, "-h 200" will set the syscons(4) or vt(4) scrollback (history) buffer to 200 lines. 📜
cron_enable — bool. If set to "YES", run the cron(8) daemon at system boot time. ⏰
cron_program — str. Path to cron(8) (default /usr/sbin/cron).
cron_flags — str. If cron_enable is set to "YES", these are the flags to pass to cron(8).
cron_dst — bool. If set to "YES", enable the special handling of transitions to and from the Daylight Saving Time in cron(8) (equivalent to using the flag -s). 🕰️
lpd_program — str. Path to lpd(8) (default /usr/sbin/lpd).
lpd_enable — bool. If set to "YES", run the lpd(8) daemon at system boot time. 🖨️
lpd_flags — str. If lpd_enable is set to "YES", these are the flags to pass to the lpd(8) daemon.
chkprintcap_enable — bool. If set to "YES", run the chkprintcap(8) command before starting the lpd(8) daemon.
chkprintcap_flags — str. If lpd_enable and chkprintcap_enable are set to "YES", these are the flags to pass to the chkprintcap(8) program. The default is "-d", which causes missing directories to be created. 📁✨
dumpdev — str. Indicates the device (usually a swap partition) to which a crash dump should be written in the event of a system crash. If the value of this variable is "AUTO", the first suitable swap device listed in /etc/fstab will be used as the dump device. Otherwise, the value of this variable is passed as the argument to dumpon(8) and savecore(8). To disable crash dumps, set this variable to "NO". 💀
dumpon_flags — str. Flags to pass to dumpon(8) when configuring dumpdev as the system dump device. 🫶
dumpdir (str) — okay so picture this 😭 your system reboots after a crash, there's a crash dump sitting on the device set by the dumpdev variable, and savecore(8) is like "say less, I got you" — it saves that crash dump and a copy of the kernel into the directory you point at with dumpdir. The default value is /var/crash. And here's the plot twist: set it to "NO" and savecore(8) just won't run at boot time when dumpdir is set. slay, but choose wisely bestie 💅
savecore_enable (bool) — set this to "NO" and you're disabling automatic extraction of the crash dump from the dumpdev. that's it, that's the whole vibe.
savecore_flags (str) — if crash dumps are enabled, these are the flags you pass to the savecore(8) utility. ✨
quota_enable (bool) — set to "YES" to turn on user and group disk quotas on system startup via the quotaon(8) command, for all the file systems marked as having quotas enabled in /etc/fstab.

ok important caveat bestie 🚨 the kernel must be built with options QUOTA for disk quotas to function at all. no kernel option, no quotas, no cap.

check_quotas (bool) — set to "YES" to enable user and group disk quota checking via the quotacheck(8) command. responsible queen behaviour 🎀
quotacheck_flags (str) — if quota_enable is set to "YES" and check_quotas is set to "YES", these are the flags to pass to the quotacheck(8) utility. The default is "-a", which checks quotas for all file systems with quotas enabled in /etc/fstab.
quotaon_flags (str) — if quota_enable is set to "YES", these are the flags to pass to the quotaon(8) utility. The default is "-a", which enables quotas for all file systems with quotas enabled in /etc/fstab.
quotaoff_flags (str) — if quota_enable is set to "YES", these are the flags to pass to the quotaoff(8) utility when shutting down the quota system. The default is "-a", which disables quotas for all file systems with quotas enabled in /etc/fstab. it's giving cleanup era 🧹
accounting_enable (bool) — set to "YES" to enable system accounting through the accton(8) facility. receipts, but make it system-wide 📊
firstboot_sentinel (str) — this variable specifies the full path to a "first boot" sentinel file. The way it works: if a file exists with this path, rc.d scripts with the "firstboot" keyword will be run on startup, and then the sentinel file gets deleted after the boot process completes 🦋 The sentinel file must be located on a writable file system which is mounted no later than early_late_divider to function properly — like, that part is not optional, bestie. The default is /firstboot.
linux_enable (bool) — set to "YES" to enable Linux/ELF binary emulation at system initial boot time. little translation era for the linux besties 🐧
sysvipc_enable (bool) — if set to "YES", load System V IPC primitives at boot time.
clear_tmp_enable (bool) — set to "YES" and /tmp gets cleaned at startup. fresh start energy 🌸
clear_tmp_X (bool) — set to "NO" to disable removing of X11 lock files, and the removal and (secure) recreation of the various socket directories for X11 related programs. so like, "NO" here means "please leave my X11 stuff alone" 🙈
ldconfig_paths (str) — set this to the list of shared library paths to use with ldconfig(8).

NOTE: /lib and /usr/lib will always be added first, so they don't need to appear in this list. you can chill, they're already invited to the party 💖

ldconfig32_paths (str) — set this to the list of 32-bit compatibility shared library paths to use with ldconfig(8). retro girlies rise 🎀
ldconfig_insecure (bool) — so ldconfig(8) normally refuses to use directories which are writable by anyone except root (security queen behaviour, honestly 👑). Set this variable to "YES" to disable that security check during system startup.

⚠️ yeah that's the whole point of the name — "YES" here means insecure. you've been warned, bestie 💀

ldconfig_local_dirs (str) — set this to the list of local ldconfig(8) directories. The names of all files in the directories listed will be passed as arguments to ldconfig(8). it's giving "here's my whole roster" 📋
ldconfig_local32_dirs (str) — set this to the list of local 32-bit compatibility ldconfig(8) directories. The names of all files in the directories listed will be passed as arguments to ldconfig -32.
kern_securelevel_enable (bool) — set to "YES" to set the kernel security level at system startup. lock it down, gorgeous 🔒
kern_securelevel (int) — the kernel security level to set at startup. The allowed range of value ranges from -1 (the compile time default) all the way to 3 (the most secure). See security(7) for the list of possible security levels and their effect on system operation. iykyk, level 3 is the final boss 🌈
sshd_program (str) — path to the SSH server program. (/usr/sbin/sshd is the default.)
sshd_enable (bool) — set to "YES" to start sshd(8) at system boot time. Note: the sshd_oomprotect variable is set to "YES" by default in /etc/defaults/rc.conf.
sshd_flags (str) — if sshd_enable is set to "YES", these are the flags to pass to the sshd(8) daemon.
watchdogd_enable (bool) — if set to "YES", start the watchdogd(8) daemon at boot time. This requires that the kernel have been compiled with a watchdog(4) compatible device. no device, no watchdog, that's the deal 🐕
watchdogd_flags (str) — if watchdogd_enable is set to "YES", these are the flags passed to the watchdogd(8) daemon.
watchdogd_timeout (int) — if watchdogd_enable is set to "YES", this is a timeout that will be used by the watchdogd(8) daemon. If this option is set, it overrides -t in watchdogd_flags. so this one wins the argument 💅
watchdogd_shutdown_timeout (int) — if watchdogd_enable is set to "YES", this is a timeout that will be set by the watchdogd(8) daemon when it exits during the system shutdown. This timeout will not be set when returning to the single-user mode, or when the watchdogd service is stopped individually using the service(8) command or the rc.d script. Note that the timeout will be applied if watchdogd(8) is stopped outside of the rc(8) framework. If this option is set, it overrides -x in watchdogd_flags. yes it's a lot of conditions, write them down bestie 📝
devfs_rulesets (str) — list of files containing sets of rules for devfs(8).
devfs_system_ruleset (str) — rule name(s) to apply to the system /dev itself.
devfs_set_rulesets (str) — pairs of already-mounted dev directories and rulesets that should be applied to them. For example:

/mount/dev=ruleset_name

devfs_load_rulesets (bool) — if set, always load the default rulesets listed in devfs_rulesets. consistency icon ✨
performance_cx_lowest (str) — the CPU idle state to use while on AC power. The string "LOW" indicates that acpi(4) should use the lowest power state available, while "HIGH" indicates that the lowest latency state (less power savings) should be used. so "high" is actually the less sleepy one, confusing but that's the tea 🍵
performance_cpu_freq (str) — the CPU clock frequency to use while on AC power. The string "LOW" indicates that cpufreq(4) should use the lowest frequency available, while "HIGH" indicates that the highest frequency (less power savings) should be used.
economy_cx_lowest (str) — the CPU idle state to use when off AC power. The string "LOW" indicates that acpi(4) should use the lowest power state available, while "HIGH" indicates that the lowest latency state (less power savings) should be used. battery-saving era 🔋
economy_cpu_freq (str) — the CPU clock frequency to use when off AC power. The string "LOW" indicates that cpufreq(4) should use the lowest frequency available, while "HIGH" indicates that the highest frequency (less power savings) should be used.
jail_enable (bool) — if set to "NO", any configured jails will not be started. everyone stays home 🏠
jail_conf (str) — the configuration filename used by the jail(8) utility. The default value is /etc/jail.conf. /etc/jail.⟨jname⟩.conf and /etc/jail.conf.d/⟨jname⟩.conf will also be used if ⟨jname⟩ is set in jail_list. so many files, so many options, we love a flexible queen 💅
jail_parallel_start (bool) — if set to "YES", all configured jails will be started in the background (in parallel). multitasking icon 🦋
jail_flags (str) — unset by default. When set, use as default value for jail_⟨jname⟩_flags for every jail in jail_list.
jail_list (str) — a space-delimited list of jail names. When left empty, all of the jail(8) instances defined in the configuration file are started. The names you put in this list control the jail startup order. jail(8) instances missing from jail_list must be started manually. Also note that a jail's depend parameter in the configuration file may override this list. lineup drama, but make it orderly 📋
jail_reverse_stop (bool) — when set to "YES", all configured jails in jail_list are stopped in reverse order. last in, first out, periodt 🔄

jail_* variables — okay so heads up: older releases supported per-jail configuration via rc.conf variables. For example, the hostname of a jail named vjail was able to be set by jail_vjail_hostname. These per-jail configuration variables are now obsolete in favor of the jail(8) configuration file. For backward compatibility though, when per-jail configuration variables are defined, jail(8) configuration files are created as /var/run/jail.⟨jname⟩.conf and used. legacy behaviour, but we respect it 🫶

The following per-jail parameters are handled by the rc.d/jail script out of their corresponding rc.conf variables. In addition to them, parameters in jail_⟨jname⟩_parameters will be added to the configuration file. They must be a semi-colon (;) delimited list of "key=value". For more details, see the jail(8) manual page.

path — set from jail_⟨jname⟩_rootdir
host.hostname — set from jail_⟨jname⟩_hostname
exec.consolelog — set from jail_⟨jname⟩_consolelog. The default value is /var/log/jail_⟨jname⟩_console.log.

interface — set from jail_⟨jname⟩_interface.
vnet.interface — set from jail_⟨jname⟩_vnet_interface. Bestie, heads up: this one implies the vnet parameter gets enabled, and you literally cannot specify it at the same time as jail_⟨jname⟩_interface, jail_⟨jname⟩_ip and/or jail_⟨jname⟩_ip_multi⟨n⟩. Pick a lane 💅
fstab — set from jail_⟨jname⟩_fstab
mount — set from jail_⟨jname⟩_procfs_enable.
exec.fib — set from jail_⟨jname⟩_fib
exec.start — set from jail_⟨jname⟩_exec_start. Fun lore drop: the parameter name was command in some older releases 🫶
exec.prestart — set from jail_⟨jname⟩_exec_prestart
exec.poststart — set from jail_⟨jname⟩_exec_poststart
exec.stop — set from jail_⟨jname⟩_exec_stop
exec.prestop — set from jail_⟨jname⟩_exec_prestop
exec.poststop — set from jail_⟨jname⟩_exec_poststop
ip4.addr — set if jail_⟨jname⟩_ip or jail_⟨jname⟩_ip_multi⟨n⟩ contain IPv4 addresses
ip6.addr — set if jail_⟨jname⟩_ip or jail_⟨jname⟩_ip_multi⟨n⟩ contain IPv6 addresses
allow.mount — set from jail_⟨jname⟩_mount_enable
mount.devfs — set from jail_⟨jname⟩_devfs_enable
devfs_ruleset — set from jail_⟨jname⟩_devfs_ruleset. This must be an integer, not a string. No cap, it will not accept your cute little string era 🙈
mount.fdescfs — set from jail_⟨jname⟩_fdescfs_enable
allow.set_hostname — set from jail_⟨jname⟩_set_hostname_allow
allow.rawsocket — set from jail_⟨jname⟩_socket_unixiproute_only
allow.sysvipc — set from jail_⟨jname⟩_sysvipc_allow

🌸 the rest of the variables, part ten, let's go 🌸

harvest_mask — (int) Set this to a bit-mask representing the entropy sources you wish to harvest. Want the tea? Go read random(4) for more info ✨
entropy_dir — (str) Set to “NO” to disable caching entropy via cron(8). Otherwise, set it to the directory where the entropy files are stored. For this to actually be useful, there has to be a system cron job that regularly writes and rotates files here — all files found will be used at boot time. The default is /var/db/entropy.
entropy_file — (str) Set to “NO” to disable caching entropy through reboots. Otherwise, set it to the name of a file used to store cached entropy. This file should live on a file system that's readable before all the volumes specified in fstab(5) are mounted. By default, /entropy is used, but if /var/db/entropy-file is found it will also be used. This will be of some use to bsdinstall(8) 🫶
entropy_boot_file — (str) Set to “NO” to disable very early caching entropy through reboots. Otherwise, set it to the filename used to read very early reboot cached entropy. This file should be somewhere loader(8) can read it. See also loader.conf(5). The default location is /boot/entropy 💖
entropy_save_sz — (int) Size of the entropy cache files saved by save-entropy periodically.
entropy_save_num — (int) Number of entropy cache files to save by save-entropy periodically.
ipsec_enable — (bool) Set to “YES” to run setkey(8) on ipsec_file at boot time.
ipsec_file — (str) Configuration file for setkey(8).
dmesg_enable — (bool) Set to “YES” to save dmesg(8) to /var/run/dmesg.boot on boot 🔥
rcshutdown_timeout — (int) If set, start a watchdog timer in the background which will terminate rc.shutdown if shutdown(8) has not completed within the specified time (in seconds). Notice! In addition to this soft timeout, init(8) also applies a hard timeout for the execution of rc.shutdown. This is configured via the sysctl(8) variable kern.init_shutdown_timeout and defaults to 120 seconds. Setting the value of rcshutdown_timeout to more than 120 seconds will have no effect until the sysctl(8) variable kern.init_shutdown_timeout is also increased. Like, the vibes won't sync until both sides match, iykyk 💀
virecover_enable — (bool) Set to “NO” to prevent the system from trying to recover prematurely terminated vi(1) sessions. RIP to your crashed edits, girl 😭
ugidfw_enable — (bool) Set to “YES” to load the mac_bsdextended(4) module upon system initialization and load a default ruleset file.
bsdextended_script — (str) The default mac_bsdextended(4) ruleset file to load. The default value of this variable is /etc/rc.bsdextended.
newsyslog_enable — (bool) If set to “YES”, run the newsyslog(8) command at startup.
newsyslog_flags — (str) If newsyslog_enable is set to “YES”, these are the flags to pass to the newsyslog(8) program. The default is “-CN”, which causes log files flagged with a C to be created. Iconic little flag combo honestly ✨
mdconfig_md⟨X⟩ — (str) Arguments to mdconfig(8) for md(4) device X. At minimum a -t type must be specified and either a -s size for malloc or swap backed md(4) devices, or a -f file for vnode backed md(4) devices. Note that mdconfig_md⟨X⟩ variables are evaluated until one variable is unset or null. So it keeps going till something's empty, bestie 🧚
mdconfig_md⟨X⟩_newfs — (str) Optional arguments passed to newfs(8) to initialize md(4) device X.
mdconfig_md⟨X⟩_owner — (str) An ownership specification passed to chown(8) after the specified md(4) device X has been mounted. Both the md(4) device and the mount point will be changed. Two for the price of one, slay 💅
mdconfig_md⟨X⟩_perms — (str) A mode string passed to chmod(1) after the specified md(4) device X has been mounted. Both the md(4) device and the mount point will be changed.
mdconfig_md⟨X⟩_files — (str) Files to be copied to the mount point of the md(4) device X after it has been mounted.
mdconfig_md⟨X⟩_cmd — (str) Command to execute after the specified md(4) device X has been mounted. Heads up: the command is passed to eval, and both the _dev and _mp variables can be used to reference respectively the md(4) device and the mount point. Assuming that the md(4) device is md0, one could set the following:

mdconfig_md0_cmd="tar xfzC /var/file.tgz \${_mp}"

autobridge_interfaces — (str) Set to the list of bridge interfaces that newly arriving interfaces will be checked against to be automatically added. If not set to “NO” then, for each whitespace separated element in the value, a autobridge_⟨element⟩ variable is assumed to exist which has a whitespace separated list of interface names to match — and those names can use wildcards 🦋 For example:

autobridge_interfaces="bridge0"
autobridge_bridge0="tap* dc0 vlan[345]"

mixer_enable — (bool) If set to “YES”, enable support for the sound mixer 🎀
hcsecd_enable — (bool) If set to “YES”, enable the Bluetooth security daemon.
hcsecd_config — (str) Configuration file for hcsecd(8). Default /etc/bluetooth/hcsecd.conf.
sdpd_enable — (bool) If set to “YES”, enable the Bluetooth Service Discovery Protocol daemon.
sdpd_control — (str) Path to the sdpd(8) control socket. Default /var/run/sdp.
sdpd_groupname — (str) Sets the sdpd(8) group to run as after it initializes. Default “nobody”.
sdpd_username — (str) Sets the sdpd(8) user to run as after it initializes. Default “nobody”.
bthidd_enable — (bool) If set to “YES”, enable the Bluetooth Human Interface Device daemon.
bthidd_config — (str) Configuration file for bthidd(8). Default /etc/bluetooth/bthidd.conf.
bthidd_hids — (str) Path to a file where bthidd(8) will store information about known HID devices. Default /var/db/bthidd.hids.
rfcomm_pppd_server_enable — (bool) If set to “YES”, enable the Bluetooth RFCOMM PPP wrapper daemon.
rfcomm_pppd_server_profile — (str) The name of the profile to use from /etc/ppp/ppp.conf. Multiple profiles can be specified here — it's also used to specify per-profile overrides. When the profile name contains any of the characters “.-/+” they are translated to “_” for the purposes of the override variable names. So like, the actual chars get swapped for underscores behind the scenes, periodt 🌈
rfcomm_pppd_server_⟨profile⟩_bdaddr — (str) Overrides the local address to listen on. By default rfcomm_pppd(8) will listen on the “ANY” address. The address can be specified as BD_ADDR or name.
rfcomm_pppd_server_⟨profile⟩_channel — (str) Overrides the local RFCOMM channel to listen on. By default rfcomm_pppd(8) will listen on RFCOMM channel 1. Must be set properly if multiple profiles are used at the same time — like, don't be messy about it 😭
rfcomm_pppd_server_⟨profile⟩_register_sp — (bool) Tells rfcomm_pppd(8) if it should register Serial Port service on the specified RFCOMM channel. Default “NO”.
rfcomm_pppd_server_⟨profile⟩_register_dun — (bool) Tells rfcomm_pppd(8) if it should register Dial-Up Networking service on the specified RFCOMM channel. Default “NO”.
ubthidhci_enable — (bool) set this to “YES” and your USB Bluetooth controller flips out of HID mode and into HCI mode 🔄. It's a whole glow-up for your dongle. Fair warning tho: it doesn't fly solo — you also have to tell it where the controller lives via ubthidhci_busnum and ubthidhci_addr. No cap.
ubthidhci_busnum — the bus number where that USB Bluetooth controller is chilling. How do you find it? run usbconfig(8) on your system and it'll spill the tea 💅.
ubthidhci_addr — the bus address of the USB Bluetooth controller. Same deal bestie: peep the output of usbconfig(8) on your system to find this info 🔍.
utx_enable — (bool) set to “YES” and user accounting gets switched on through the utx(8) facility 📊✨.
netwait_enable — (bool) if you set this to “YES”, it delays the start of your network-reliant services until three things have happened:
1. netwait_if is up
2. duplicate address discovery (DAD) has completed
3. ICMP packets to a destination defined in netwait_ip are actually flowing 🛰️

The order is very much a thing: link state gets examined first, then DAD, then it “pings” an IP address to verify the network is even usable. But — if no destination can be reached or timeouts are exceeded, network services get started anyway with no guarantee that the network is usable. Yeah. It just sends it 🙈.

netwait_ip — (str) empty by default. This is your space-delimited list of IP addresses to ping(8) 🏓. Do NOT use DNS hostnames here — resolution isn't guaranteed to be functional at this point, so that's a whole mess waiting to happen. If you specify multiple IP addresses, each one gets tried until one succeeds or the list is fully exhausted.
netwait_timeout — (int) the total number of seconds to “ping” each IP address in netwait_ip, at a rate of one ping per second ⏱️. If any of those pings come back successful, full network connectivity is considered reliable. Default is 60.
netwait_if — (str) empty by default. This defines the name of the network interface to watch the link on 👀. ifconfig(8) is used to monitor the interface, sitting there looking for “status: no carrier”. Once that's gone, the link is considered up 💚. And yes, this can be a vlan(4) interface if that's the vibe you want.
netwait_if_timeout — (int) the total number of seconds to wait for the link to become usable, polled at a 1-second interval. Default is 30 ⏳.
netwait_dad — (str) set to “NO” by default. Flip it to “YES” to enable waiting for DAD to complete ✨.
netwait_dad_timeout — (int) unset by default. This is the max number of seconds to wait for DAD to complete. If it's zero or unset, the timeout will be one more than the value of the net.inet6.ip6.dad_count sysctl variable 🔢.
rctl_enable — (bool) set to “YES” and it loads rctl(8) rules from the defined ruleset 🎛️. Heads up: your kernel has to be built with options RACCT and options RCTL or this whole thing is a no-op.
rctl_rules — (str) set to /etc/rctl.conf by default. This variable contains the rctl.conf(5) ruleset to load for rctl(8) 📜.
iovctl_files — (str) a space-separated list of configuration files used by iovctl(8). Default value is an empty string 🫙.
autofs_enable — (bool) set to “YES” and it starts the automount(8) utility plus the automountd(8) and autounmountd(8) daemons at boot time 🚀.
automount_flags — (str) if autofs_enable is set to “YES”, these are the flags to pass to the automount(8) program. By default no flags are passed 🏳️.
automountd_flags — (str) if autofs_enable is set to “YES”, these are the flags to pass to the automountd(8) daemon. By default, again, no flags 🏳️.
autounmountd_flags — (str) if autofs_enable is set to “YES”, these are the flags to pass to the autounmountd(8) daemon. By default no flags 🏳️.
ctld_enable — (bool) set to “YES” and the ctld(8) daemon starts at boot time 🔥.
iscsid_enable — (bool) set to “YES” and the iscsid(8) daemon starts at boot time 🔥.
iscsictl_enable — (bool) set to “YES” and the iscsictl(8) utility starts at boot time 🔥.
iscsictl_flags — (str) if iscsictl_enable is set to “YES”, these are the flags to pass to the iscsictl(8) program. The default is -Aa, which configures sessions based on the /etc/iscsi.conf configuration file 🗂️.
cfumass_enable — (bool) set to “YES” and it creates and exports a USB LUN using cfumass(4) at boot time 🔌.
cfumass_dir — (str) the directory where the files exported by that USB LUN are located. Default directory is /var/cfumass 📁.
service_delete_empty — (bool) set to “YES” and service delete removes empty “rc.conf.d” files 🧹✨.
zfs_bootonce_activate — (bool) set to “YES” and if a boot environment marked bootonce boots successfully, it gets made permanently active 👑. Main character boot environment behaviour, honestly.
zfskeys_enable — (bool) set to “YES” to enable auto-loading of encryption keys for encrypted ZFS datasets 🔐. For every dataset, the script will first load the appropriate encryption key and then attempt to unlock the dataset.

Important deets: the script operates only on datasets which are encrypted with ZFS native encryption and have a ZFS “keylocation” dataset property beginning with “file://” 📂.

zfskeys_datasets — (str) a whitespace-separated list of ZFS datasets to unlock. The list is empty by default, which means the script will attempt to unlock all datasets 😤.
zfskeys_timeout — (int) the total number of seconds to wait for the zfskeys script to unlock an encrypted dataset. Default is 10 ⏲️.
sendmail_enable — (str) if set to “YES”, run the sendmail(8) daemon at system boot time 📨. If set to “NO”, don't run a sendmail(8) daemon to listen for incoming network mail — but this does not preclude a sendmail(8) daemon listening on the SMTP port of the loopback interface. The “NONE” option sets each of sendmail_enable, sendmail_submit_enable, sendmail_outbound_enable, sendmail_msp_queue_enable to “NO” 💀.
sendmail_cert_create — (str) if sendmail_enable is set to “YES”, this creates a signed certificate /etc/mail/certs/host.cert representing /etc/mail/certs/host.key by the CA certificate in /etc/mail/certs/cacert.pem 📜🔏. This enables connecting hosts to negotiate STARTTLS, allowing incoming email to be encrypted in transit 🔒. sendmail(8) needs to be configured to use these generated files — and the default configuration in /etc/mail/freebsd.mc has the required options in it, so that's convenient.
sendmail_cert_cn — (str) if sendmail_enable is set to “YES” and sendmail_cert_create is set to “YES”, this is the Common Name (CN) of the certificate that will be created 🏷️. If sendmail_cert_cn isn't set, the system's hostname gets used. And if there's no hostname set, “amnesiac” will be used 😭 (iconic fallback name tbh).
sendmail_flags — (str) if sendmail_enable is set to “YES”, these are the flags to pass to the sendmail(8) daemon 🚩.
sendmail_submit_enable — (bool) if set to “YES” and sendmail_enable is set to “NO”, run sendmail(8) using sendmail_submit_flags instead of sendmail_flags 🔁. This is intended to allow local mail submission via a localhost-only listening SMTP service, which is required for running sendmail(8) as a non-set-user-ID binary. Note that this does not work inside jail(2) systems, because jails don't allow binding to just the localhost interface 🚫.
sendmail_submit_flags — (str) if sendmail_enable is set to “NO” and sendmail_submit_enable is set to “YES”, these are the flags to pass to the sendmail(8) daemon 🚩.
sendmail_outbound_enable — (bool) if set to “YES” and both sendmail_enable and sendmail_submit_enable are set to “NO”, run sendmail(8) using sendmail_outbound_flags instead of sendmail_flags 🔁. This is intended to allow local mail queue management for systems that don't offer a listening SMTP service 📬.
sendmail_outbound_flags — (str) if both sendmail_enable and sendmail_submit_enable are set to “NO” and sendmail_outbound_enable is set to “YES”, these are the flags to pass to the sendmail(8) daemon 🚩.
sendmail_msp_queue_enable — (bool) if set to “YES”, start a client (MSP) queue runner sendmail(8) daemon at system boot time 🏃. As of sendmail 8.12, a separate queue is used for command line submissions. The client queue runner ensures that nothing is left behind in the submission queue 🧼.
sendmail_msp_queue_flags — (str) if sendmail_msp_queue_enable is set to daemon. “YES”, these are the flags to pass to the sendmail(8)

💀 ngl bestie, that line is literally scrambled like that in the original manpage — words dropped mid-sentence and everything. I'm not gonna pretend I know better, so I'm handing it to you exactly as written. You get what it means: flags for the sendmail(8) daemon when sendmail_msp_queue_enable is “YES”. 🙈

precious_machine — if set to “YES”, some destructive actions require removal of the action-specific safe-belts before being allowed 🛡️. For instance, the file /var/run/noshutdown is created to prevent shutdown(8) targeted at the wrong machine 😭💀. Your machine is precious. Protect her.
virtual_oss_enable — (bool) if set to “YES”, run one virtual_oss(8) instance for each configuration defined in virtual_oss_configs 🎧✨.
virtual_oss_configs — (str) a space-separated list of virtual_oss(8) configurations. For example:

virtual_oss_configs="foo bar"

Configurations need to be defined in virtual_oss_⟨config_name⟩. By default, there's a dsp configuration which replaces the /dev/dsp device created by sound(4) with a virtual_oss(8) one 🎶. It can be redefined by setting the virtual_oss_dsp variable 🦋.

virtual_oss_⟨config_name⟩ — (str) the argument list you'd hand to virtual_oss(8) for the configuration called ⟨config_name⟩ ✨
virtual_oss_default_control_device — (str) the name of the virtual_oss(8) control device that goes with the default config, virtual_oss_dsp. Out of the box it's set to vdsp.ctl 🎀 if you set virtual_oss_dsp, bestie, you are strongly encouraged to set this one too and use it as the argument for the -t option inside virtual_oss_dsp — because other programs and scripts literally rely on it, like /etc/devd/snd.conf 👀

🌸 SERVICE JAILS 🌸

okay so this is the part where the rc system's service-jail feature just… scoops your service up and puts it in a jail 🫶 That jail inherits the filesystem and a bunch of other bits from the parent (and yes, if you allow child-jails in your jails, service jails work inside jails too) — all depending on what you put in the ⟨name⟩_svcj_options variable. Usually you'd set that inside rc scripts, but you can override it in the rc config. Here's what's valid to put in ⟨name⟩_svcj_options:

mlock — lets you lock memory pages into physical memory 🔒
netv4 — gives IPv4 network access plus the ability to bind to reserved ports. If ⟨name⟩_svcj_ipaddrs is set, only the IPv4 addresses listed there are visible to the jail; otherwise all assigned IPv4 addresses are visible. Cannot be combined with netv6 💀
netv6 — gives IPv6 network access plus the ability to bind to reserved ports. If ⟨name⟩_svcj_ipaddrs is set, only the IPv6 addresses listed there are visible to the jail; otherwise all assigned IPv6 addresses are visible. Cannot be combined with netv4 💀
net_basic — same energy as turning on both netv6 and netv4 ✨
net_raw — allows opening raw sockets. This one can be combined with netv4, netv6, and net_basic 👑
net_all — gives IPv6 and IPv4 network access like netv4 and netv6, allows opening raw sockets, and lets you open sockets from protocol stacks that haven't had jail functionality added to them yet 🌈
nfsd — lets you run nfsd and its affiliated daemons 📁
routing — lets you modify the system routing table 🛣️
settime — lets you set and slew the system time ⏰
sysvipc — inherits the SysV semaphores, SysV shared memory, and SysV messages from the host or the parent jail 🧬
sysvipcnew — creates a brand-new namespace for SysV semaphores, SysV shared memory, and SysV messages for this particular service jail 🐣
vmm — allows access to vmm(4). This option only exists when vmm(4) is enabled in the kernel, iykyk 💅

Real talk on combining them: all non-network options can be combined with all the other options. From the SysV options, only one can be specified. Periodt 🎀

If ⟨name⟩_svcj is set to “YES”, that particular service starts up inside a service jail named svcj-name 🦋

Then there's the svcj_all_enable variable — it lets you turn on service jails for all the services on the system at once 👑 Services that have ⟨name⟩_svcj set to “NO” get excluded. Some services set ⟨name⟩_svcj to “NO” right in the script, either to prevent service jails for that service entirely, or to set it to “NO” when it isn't set in the rc config — that way it's excluded from svcj_all_enable but you can still explicitly enable it if you want. Example time: the sshd service wouldn't be able to see other jails if it ran as a service jail 👀 which may or may not be what you actually need, so it's excluded from svcj_all_enable — but you can turn it on by setting sshd_svcj to “YES” 💖

🎀 FILES 🎀

/etc/defaults/rc.conf
/etc/defaults/vendor.conf
/etc/rc.conf
/etc/rc.conf.local
/etc/rc.conf.d/

🦋 SEE ALSO 🦋

chmod(1), cpuset(1), gdb(1) (ports/devel/gdb), kbdcontrol(1), limits(1), protect(1), sh(1), umask(1), uuidgen(1), vi(1), vidcontrol(1), bridge(4), dummynet(4), ip(4), ipf(4), ipfw(4), ipnat(4), kld(4), pf(4), pflog(4), pfsync(4), tcp(4), udp(4), exports(5), fstab(5), ipf(5), ipnat(5), jail.conf(5), loader.conf(5), login.conf(5), motd(5), newsyslog.conf(5), pf.conf(5), firewall(7), growfs(7), security(7), tuning(7), accton(8), apm(8), bsdinstall(8), bthidd(8), chkprintcap(8), chown(8), cron(8), devfs(8), dhclient(8), geli(8), hcsecd(8), ifconfig(8), inetd(8), iovctl(8), ipf(8), ipfw(8), ipnat(8), jail(8), kldxref(8), loader(8), lpd(8), makewhatis(8), mdconfig(8), mdmfs(8), mixer(8), mountd(8), moused(8), newfs(8), newsyslog(8), nfsd(8), ntpd(8), ntpdate(8), pfctl(8), pflogd(8), ping(8), powerd(8), quotacheck(8), quotaon(8), rc(8), rc.subr(8), rcorder(8), rfcomm_pppd(8), route(8), route6d(8), routed(8), rpc.lockd(8), rpc.statd(8), rpc.tlsclntd(8), rpc.tlsservd(8), rpcbind(8), rwhod(8), savecore(8), sdpd(8), sendmail(8), service(8), sshd(8), swapon(8), sysctl(8), syslogd(8), sysrc(8), unbound(8), usbconfig(8), utx(8), virtual_oss(8), wlandebug(8), yp(8), ypbind(8), ypserv(8), ypset(8) 🌈

Yeah. That's a lot of friends. Go read them, they're all slay 💅

⭐ HISTORY ⭐

The rc.conf file showed up in FreeBSD 2.2.2 — vintage icon behavior, honestly 🎀

👑 AUTHORS 👑

Jordan K. Hubbard.

and that's the whole page, bestie!! you made it to the end 🎉💖

this lil beauty comes to you from Debian, dated April 2, 2026, and it lives at section RC.CONF(5) in the manual — go forth and configure responsibly 🫶✨🌸

📦 where this page comes from

freebsd 15.1: base 15.1
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms