[Shorewall-devel] send patchs

Tom Eastep
Fri, 20 May 2005 12:48:26 -0000

Juan J. Prieto wrote:
>
>
>   Also, some of our clients need to permit all new traffic during
> iptables compilling (shorewall start or restart) because they have a
> great number of zones and rules, so I have had to add a new
> configuration variable POLICY_ACCEPT_STARTING. If it is set to
''Yes'',
> then DROP default policy will be added at the end of compilling period.
>

I have added the CROSSBEAM patch to 2.4.0 but I''m withholding the
POLICY_ACCEPT_STARTING patch for now. I really don''t like the idea of
an
option that opens the firewall completely like this one does.

I suspect that an option in shorewall.conf that works in conjunction with
/etc/shorewall/routestopped would be more appropriate for both the 2.2 and
2.4 series (since 2.2.3, communication *between* hosts listed in
routestopped is now enabled during [re]start).