>> You have to be very careful when reloading firewall rules remotely.
>> What I do that usually works is put rules to allow my ssh connection(s)
>> at the top of my rules file, right after the flush statement. Then I
>> can usually run "ipfw -q /etc/ipfw.conf" without getting disconnected.
>> The -q is important. Even this method is risky, though. To be really
>> sure that your new ruleset gets loaded (and loaded completely) you
>> should either reboot the machine (assuming the rules are loaded at
>> startup) or write a script and call it using cron(8) or at(1).
>> JN
> hmm...
> 1. I mentioned at my first post that when I was running ipfw -f flush &&
> sh /etc/rc.firewall &
> or ./firerestart & through my ssh's session, I was running it at
> the background ( Note the &). That means that even if my ssh session was
> to die (because of the new ipfw rules), killing the shell as well, the
> command issued should run in the back, so run eventually. That means that
> I could be able to ssh to the box later. The problem is that the command
> was never executed!! Does anybody has an answer to this??
I'm not sure on this one, but if I had to guess I'd say that your connection
is being reset, your login shell is being killed, and so is your script,
despite the fact that it's in the background. Look at the manpage for your
shell and see if "nohup" might be any help to you here.
Quote:> 2. The other funny thing is that I run: ipfw -q /etc/rc.firewall
> ,even and on the console's prompt (not ssh's session) , but I ve got the
> message:
> ipfw: error: bad arguments
> usage: ipfw [options]
> [pipe] flush
> add [number] rule
> [pipe] delete number ...
> followed by 40 more lines explaining how I m supposed to run the ipfw.
> Note that I made rc.firewall executable (chmod). Why do you think I
> can't run it the command ipfw -q /etc/rc.firewall ??
My mistake--I should have been more clear. I have one file that's my actual
firewall _script_ (and it gets pointed to by rc.conf), and another file that
contains my firewall _rules_. The script is dead-simple:
#!/bin/sh
/sbin/ipfw -q /etc/ipfw.conf
The other file (in my case /etc/ipfw.conf) is where all the fancy stuff
occurs. It is not a script, but rather a rules file. From the ipfw(8)
manpage:
"To ease configuration, rules can be put into a file which is processed
using ipfw as shown in the first synopsis line. An absolute pathname must
be used. The file will be read line by line and applied as arguments to the
ipfw utility".
The other way to load rules (which seems to be what you are doing) is to
create a script that calls ipfw(8) for each rule. An advantage to this
approach is that you can use the variables and control structures allowed by
your shell. I prefer to use a rules file because for me it's less hassle
and seems more intuitive.
JN
--
Remove pig-latin to reply by e-mail
by