I say that because firewall-adjust uses /etc/e-smith/events/actions/nethserver-shorewall-restart with shorewall restart and it does not destroy the set of ipset because shorewall is not stopped properly but in fact it is reloadedĪs a comparison, when you use systemctl restart shorewall, it does a stop, then a start, the set of ipset are destroyed then recreated. In general, you can edit the active iptables rules for IPv4 with a text editor by using the iptables-save command to write the rules to a file and then using the iptables-restore command to reload the new rules after youre done, e.g.: userhost: iptables-save > rules.v4 userhost: vim rules.v4 userhost: iptables-restore rules. The best evidence that shorewall restart is not a real restart is that /etc/shorewall/stopped are not triggered, this script is launched at the end of the service stop If you are using RHEL (Redhat), Fedora core or Cent os Linux just type following commands to disable the iptables firewall: service iptables save. TABLE 17.22 OPTIONS FOR IPTABLES OPTION chain rule chain chain chain chain. Shorewall configuration compiled to /var/lib/shorewall/.restart You can make Linux reread these rules with the service iptables reload command. Like you can see the diff of the two files are similar, reload and restart are the same command (except the compilation path) ~]# cat shorewall_restart
Shorewall configuration compiled to /var/lib/shorewall/.reloa | Shorewall configuration compiled to /var/lib/shorewall/.resta Use CUSTOMPREROUTING, CUSTOMPOSTROUTING and CUSTOMOUTPUT for the nat table.Just for fun ~]# shorewall restart > ~]# shorewall reload > ~]# sdiff -s shorewall_reload shorewall_restart Use CUSTOMINPUT, CUSTOMFORWARD and CUSTOMOUTPUT for the filter table. Packets pass these chains BEFORE they go through the rest of the ruleset. Instead of altering the default iptables chains (which can be very dangerous when the firewall ruleset does not work as intended), there are extra chains that MUST be used for this. Those should be added in the "start" section and be removed correspondingly in the "stop" section.ĭespite adding firewall rules, you may also start and stop system services or do anything else that can be done from a Linux shell. This is usually used for adding additional iptables rules. # /etc/sysconfig/firewall.local Usage : / etc / sysconfig / firewall.
0 kommentar(er)
