Date: Wed, 29 Nov 2006 14:05:54 -0600 From: Lane <lane@joeandlane.com> To: freebsd-questions@freebsd.org Subject: Re: Command to "dump" firewall rules to be persistent across reboots. Message-ID: <200611291405.54995.lane@joeandlane.com> In-Reply-To: <20061129143557.S55795@prime.gushi.org> References: <20061129143557.S55795@prime.gushi.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wednesday 29 November 2006 13:38, Dan Mahoney, System Admin wrote: > Hey all, I'm experimenting with ipfw as means of controlling some > interesting anomalies like with portsenty or some ssh anti-brute-force > scripts (i.e. adding bad hosts to tables, adding deny rules > for certain hosts, etc), and I was wondering if there was (either in the > form of a script, or a builtin command I can't find) some way to just > "dump" all the ipfw data (pipes, queues, tables, etc) to a single file to > be re-read on boot? > > I'd be willing to try and write something like this if it doesn't already > exist, but I'm rather surprised it doesn't. > > -Dan Mahoney > > -- > > "A single death is a tragedy. A million deaths is a statistic." > > -Josef Stalin, As quoted on the cover to Savatage's "Dead Winter Dead" > > --------Dan Mahoney-------- > Techie, Sysadmin, WebGeek > Gushi on efnet/undernet IRC > ICQ: 13735144 AIM: LarpGM > Site: http://www.gushi.org > --------------------------- Dan, Take a look at "man rc.shutdown" I don't know if it's exactly what you want, but there may be another way: Write a script in /usr/local/etc/rc.d that responds to the "start" and "stop" parameters. In the "stop" section you can output "ipfw list" to a file. Then in the "start" section you can read that file and run each line, essentially unmodified, agains ipfw. good luck! lane
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200611291405.54995.lane>