Is it possible to restart IPFW or reload its script remotely via ssh connection without loosing current connection?
I think I found the answer to my question:
In this discussion my question answered partially. Yes, indeed when you run script, it flushes all rules, because many scripts at the beginning uses this line
ipfw -f flush.
But according to documentation , there is a special set 31, which cannot be disabled, and rules in set 31 are not deleted by the
ipfw flush command (but you can delete them with the
ipfw delete set 31 command). So just add
set 31 after rule number in your script and restarting will not affect that rules which disconnect your ssh connection. As an example:
$cmd 00410 set 31 allow tcp from any to me 22 in via $pif setup keep-state
$cmd 00280 set 31 allow log tcp from any to any 22 out via $pif setup keep-state
If you're only concerned about your SSH session, then you can avoid the disconnect that occurs when the dynamic rules table gets flushed by using only static rules for your SSH early in your rules:
For example, instead of:
ipfw add 100 allow tcp from any to any 22 in via $pif setup keep-state ipfw add 101 allow ip from any 22 to any out via $pif setup keep-state
ipfw add 100 allow ip from any to any 22 in via $pif ipfw add 101 allow ip from any 22 to any out via $pif