Date: Sun, 14 Sep 2014 09:16:05 -0700 From: Freddie Cash <fjwcash@gmail.com> To: Willem Jan Withagen <wjw@digiware.nl> Cc: freebsd-ipfw@freebsd.org, bycn82 <bycn82@gmail.com> Subject: Re: IPFW rule sets and automatic rule numbering Message-ID: <CAOjFWZ4yhLd=kSLAnSYR=%2BoG3CW5HuptWOGPMbzamS7EHvavng@mail.gmail.com> In-Reply-To: <54156FBB.1030907@digiware.nl> References: <CAOjFWZ4rx4FAc4AoPw3d=cSg4-z_QOWEF=phkT2PuzfUjn0y5A@mail.gmail.com> <CAOjFWZ6i1%2BgCZ9jMnBNEGqL7airdxN3d=B0__Z_Zj1gGG4APKg@mail.gmail.com> <541469D4.6070107@gmail.com> <CAOjFWZ749EazFz1prFRfidp9bqmqO%2B=%2BXFsu7mVtE%2Bnq2CxwKw@mail.gmail.com> <54156FBB.1030907@digiware.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sep 14, 2014 3:37 AM, "Willem Jan Withagen" <wjw@digiware.nl> wrote: > > On 13-9-2014 21:51, Freddie Cash wrote: > > You can replicate it using 3 rules, loaded into two sets: > > > > ipfw set disable 1 > > ipfw add allow ip from any to any > > ipfw add 65524 allow ip from any to any > > ipfw add allow ip from any to any > > ipfw set swap 1 0 > > > > Run that two or 3 times. Every rule will be numbered 65534 after the 2nd or > > 3rd run. > > > > > I expected it to be numbered 10, 65524, 65534 after every run. > > > > However, after reading the man page a few more times and thinking about it > > a little more, it makes sense that the numbering is global across all sets, > > as you can have multiple sets enabled simultaneously. > > > > It just doesn't mesh with my desire to use auto numbering. I'm in the midst > > of manually numbering all my rules now. :) > > _______________________________________________ > > freebsd-ipfw@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org" > > > > This is easily circumvented by making shure that the first rule is Nope. It doesn't matter what the first number is. What matters is the _last_ number used. The auto-increment feature tracks the last rule number used, then adds the auto-increment number (as set by sysctl, I believe the default is 10) to any rules without explicit numbers. My rules start at 2, are specifically numbered up to 20, then I group things together by starting the server- specific scripts on even 100s or 1000s, and auto-increment through that file. Which works great if all you do is: - clear all rules (which resets the "last number" to 0) - load all rules That's what I used to do, and what I do on all school firewall boxes. Works beautifully. Has for years. No sets involved. The only downside is that it breaks all traffic for X seconds while the new rules load. Fine for a school, as it's usually under 2 seconds, and nobody notices. At the main school board office, it takes almost 30 seconds to load the rules, so I was looking into rule sets to allow for almost instantaneous loading (swap) of the rules, minimising downtime. Unfortunately, that's when I hit the =E2=80=9Drule numbers are global acros= s sets =E2=80=9D issue. It took me by surprise. It makes sense to me now, and I can work with it that way. It just want what I expected. Originally, I had hoped to just use sets without changing my scripts like so: - disable and clear set 1 - load into set 1 - swap sets 1 and 0 I can still do that, I just need to manually number all my rules first. And probably try the following: - disable and clear set 1 - load into set 1 - enable set 1 - swap sets 1 and 0 - disable set 1 That way, there shouldn't be any downtime at all, and all connections should continue during the reload.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAOjFWZ4yhLd=kSLAnSYR=%2BoG3CW5HuptWOGPMbzamS7EHvavng>