On Mon, 2011-08-22 at 07:14 -0700, Tom Eastep wrote: > > What is your objection to doing a 'shorewall restart'. Packet/Byte > counter reset? >
A couple of more things. When LSM or Shorewall-init triggers a restart, it is not a full restart that re-compiles the configuration. It is rather just a reloading of the currently-compiled configuration. One reason that I dislike the notion of modifying the running configuration in place is that it substantially increases the testing complexity. Plus, implementing your suggesting is not as straightforward as it might seem. - An interface can be either hard down (e.g., ifdown ethx) or soft down (the interface is in the UP state but the link isn't functional). The steps needed to bring the interface back up from these two different 'down' states are quite different (think about traffic shaping, for example). - Shorewall supports a 'compile' command that replaces /var/lib/shorewall/firewall. Changes in the configuration could cause up/down processing to fail or to do the wrong thing if the running configuration isn't compatible with the new one. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ uberSVN's rich system and user administration capabilities and model configuration take the hassle out of deploying and managing Subversion and the tools developers use with it. Learn more about uberSVN and get a free download at: http://p.sf.net/sfu/wandisco-dev2dev
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
