5

Is it possible to restart IPFW or reload its script remotely via ssh connection without loosing current connection?

Improve this question
4
  • Maybe you just want to use screen, so you can reconnect and resume your session? – davidbaumann Jan 3 '15 at 13:14
  • @davidbaumann Can you please explain what do you mean when you say "to use screen"? P.S. Actually in ordinary situation you can easily reconnect also, but this is the not what I mean. – b.mazgarov Jan 4 '15 at 7:31
  • man screen after installing it. aperiodic.net/screen/quick_reference – davidbaumann Jan 4 '15 at 7:38
  • @davidbaumann thanks for advise, but I don not think that is will help, because -f flush flushes everything. Even if you run this command in separate terminal, another one will also terminated. – b.mazgarov Jan 4 '15 at 11:56
1

I think I found the answer to my question: In this discussion my question answered partially. Yes, indeed when you run script, it flushes all rules, because many scripts at the beginning uses this line ipfw -f flush.

But according to documentation , there is a special set 31, which cannot be disabled, and rules in set 31 are not deleted by the ipfw flush command (but you can delete them with the ipfw delete set 31 command). So just add set 31 after rule number in your script and restarting will not affect that rules which disconnect your ssh connection. As an example:

$cmd 00410 set 31 allow tcp from any to me 22 in via $pif setup keep-state

or

$cmd 00280 set 31 allow log tcp from any to any 22 out via $pif setup keep-state
Improve this answer
2
  • There is a downside to this approach. Each time you restart the script one and the same rule is added several times. I think, there will come a time, when the rules eventually grow up so that, the processing for ipfw will be difficult. – b.mazgarov Jan 3 '15 at 5:49
  • Thinking aloud: How about to have two different script files, but how then manage that two?! – b.mazgarov Jan 3 '15 at 7:28
1

If you're only concerned about your SSH session, then you can avoid the disconnect that occurs when the dynamic rules table gets flushed by using only static rules for your SSH early in your rules:

For example, instead of:

ipfw add 100 allow tcp from any to any 22 in via $pif setup keep-state
ipfw add 101 allow ip from any 22 to any out via $pif setup keep-state

use:

ipfw add 100 allow ip from any to any 22 in via $pif
ipfw add 101 allow ip from any 22 to any out via $pif
Improve this answer
0

Assuming a SH script, "/etc/fw.rules" (FBSD's normal script is "rc.firewall" if I remember right), and sudo privileges (obviously, could run as root):

#sudo sh -c "/bin/sh /etc/fw.rules  > /dev/null 2>&1"
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.