Is it possible to restart IPFW or reload its script remotely via ssh connection without loosing current connection?

  • Maybe you just want to use screen, so you can reconnect and resume your session? Jan 3, 2015 at 13:14
  • @davidbaumann Can you please explain what do you mean when you say "to use screen"? P.S. Actually in ordinary situation you can easily reconnect also, but this is the not what I mean.
    – b.mazgarov
    Jan 4, 2015 at 7:31
  • man screen after installing it. aperiodic.net/screen/quick_reference Jan 4, 2015 at 7:38
  • @davidbaumann thanks for advise, but I don not think that is will help, because -f flush flushes everything. Even if you run this command in separate terminal, another one will also terminated.
    – b.mazgarov
    Jan 4, 2015 at 11:56

3 Answers 3


I think I found the answer to my question: In this discussion my question answered partially. Yes, indeed when you run script, it flushes all rules, because many scripts at the beginning uses this line ipfw -f flush.

But according to documentation , there is a special set 31, which cannot be disabled, and rules in set 31 are not deleted by the ipfw flush command (but you can delete them with the ipfw delete set 31 command). So just add set 31 after rule number in your script and restarting will not affect that rules which disconnect your ssh connection. As an example:

$cmd 00410 set 31 allow tcp from any to me 22 in via $pif setup keep-state


$cmd 00280 set 31 allow log tcp from any to any 22 out via $pif setup keep-state
  • There is a downside to this approach. Each time you restart the script one and the same rule is added several times. I think, there will come a time, when the rules eventually grow up so that, the processing for ipfw will be difficult.
    – b.mazgarov
    Jan 3, 2015 at 5:49
  • Thinking aloud: How about to have two different script files, but how then manage that two?!
    – b.mazgarov
    Jan 3, 2015 at 7:28

If you're only concerned about your SSH session, then you can avoid the disconnect that occurs when the dynamic rules table gets flushed by using only static rules for your SSH early in your rules:

For example, instead of:

ipfw add 100 allow tcp from any to any 22 in via $pif setup keep-state
ipfw add 101 allow ip from any 22 to any out via $pif setup keep-state


ipfw add 100 allow ip from any to any 22 in via $pif
ipfw add 101 allow ip from any 22 to any out via $pif

Assuming a SH script, "/etc/fw.rules" (FBSD's normal script is "rc.firewall" if I remember right), and sudo privileges (obviously, could run as root):

#sudo sh -c "/bin/sh /etc/fw.rules  > /dev/null 2>&1"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .