FreeBSD8.0 Firewall Script behaves much differently than 6.x

[Lowell Gilbert]

Martin McCormick <martin at dc.cis.okstate.edu> writes:

> 	Is there a proper way to reset firewall rules in
> FreeBSD8.0  ? I just discovered that if one is remotely logged
> in and makes a change in the firewall rules, it is a disastor to
> do something like
>
> sh /etc/[firewall_rules_script]
>
> 	One could do that in FreeBSD6.x. When the rules flushed,
> you lost your connection, but the script continued to execute
> and the new rules were in effect immediately. Trying this same
> reload in FreeBSD8.0, I knew something was horribly wrong when
> everything just locked up. I logged on to a local console and ran
>
> ipfw list
>
> It had stopped right after the flush.
>
> 	Doing the same command from a local or even a serial
> console works fine and the new rules are installed.
>
> 	Thanks and maybe I have been using the wrong technique
> for reloading firewall rules all along.

This situation has always existed.  See the note for "-q" in the ipfw(8)
manual and note the firewall_quiet variable in the default rc.firewall
script.  The most widely recommended approach is to run the script in a
screen(1) (or similar) session.  Even just redirecting the output is
enough to let the script run through while still keeping any potential
error information

-- 
Lowell Gilbert, embedded/networking software engineer, Boston area
		http://be-well.ilk.org/~lowell/