On Mon, 2011-08-22 at 14:56 +0100, Ed W wrote: > Hi Tom > > You have been extremely helpful to me setting up my rather niche > firewall setup (and to everyone else who posts to the shorewall list!) - > thankyou. Would you be amenable to a (paid for) feature request to > support "Dynamic Providers"? > > The basic idea is that at present if a provider is likely to be missing > at startup then we mark the interface as "optional", and some external > scripts then need to run "shorewall restart" if we detect providers > coming up/down. For my situation, I don't want to restart the entire > firewall when a provider becomes available, rather I just want to adjust > the routing, as scripted by Shorewall/Providers.pm (it doesn't seem a > stretch that others might not want to bounce the firewall when a network > cable is toggled, so I don't think this is too niche?) > > I would seek your advice on the best way to support this, but my > proposal would be: > > - If a provider is effectively optional, then a variation of the current > "is the provider up", ie Shorewall/Providers.pm:start_provider(), is > emitted to it's own function "providerN_start_stop()", rather than being > inline to setup_routing_and_traffic_shaping() > > - Additional commandline options to /var/lib/shorewall/firewall allow > starting/stopping just an individual provider > > > I don't see that this should have any functionality changes or > performance implications for current users. It would be strictly an > advanced option available for those who can use it carefully. > > In conjunction with an appropriate monitoring daemon this would allow > for providers to appear/disappear without necessarily affecting > connections on the firewall (this seems useful?) > > Grateful for your consideration?
Ed, Everything that you have asked for already exists except that the firewall is reloaded. - The 'optional' option in /etc/shorewall/providers applies to providers that use the interface. - The preferred monitoring daemon is LSM which is prominently mentioned on the Shorewall Multi-ISP page. - Shorewall-init will also trigger 'shorewall restart' if an optional interface is brought up or taken down. - The compiled script provides 'up' and 'down' commands which are used by Shorewall-init to handle up/down events. What is your objection to doing a 'shorewall restart'. Packet/Byte counter reset? -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ uberSVN's rich system and user administration capabilities and model configuration take the hassle out of deploying and managing Subversion and the tools developers use with it. Learn more about uberSVN and get a free download at: http://p.sf.net/sfu/wandisco-dev2dev
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
