On Tue, Dec 14, 2004 at 06:13:07AM -0800, Bruce M Simpson wrote:
...
> What I'm really missing in IPFW is the ability to maintain one or more
> 'shadow rulesets'. These rulesets may not be the active rulesets, but
> I can manipulate them as tables, independently of the active ruleset(s),
??? What what ???
They do exist, they are called 'set' and you can associate
rules to a specific set, atomically enable/disable/swap/rename
sets, etc. This was designed exactly for this purpose (atomic
updates of firewall configuration with a single syscall).
have a look at the ipfw manpage and then see if it answer your needs.
cheers
luigi
> IPF and PF have such functionality, IPFW does not. The lack of a documented
> ABI/API for access to IPFW by applications other than ipfw(8) is something
> which I'm leaving out of the picture for the moment.
> I don't really consider using 'skipto' and separate sections of rule
> index number space a valid answer here, because we should have the ability
> to independently flush each ruleset.
>
> When extended to stateful rules (I am talking here purely about the simple
> stateless packet filter case), this comes in even more useful.
>
> Regards,
> BMS
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
