I have ipfilter running on a Solaris 11.2 server with rules similar to:
pass in log first quick proto tcp from any to any port = 22 flags S keep state
I would like to be able to edit and reload the ipfilter configuration from /etc/ipf/ipf.conf
. However, when I run svcadm refresh ipfilter
, the dynamic state is dropped and I lose any active sessions that rely on state.
It appears that refreshing the service in Solaris takes the simple but brutal approach of:
ipf -D
ipf -E
- Load the rules from the configuration file
Is there a better way to refresh ipfilter which (a) does not drop the state, and (b) ensures that the running configuration is identical to loading the configuration from scratch?