--On Friday, December 06, 2002 12:17 PM +0200 Etienne Ledoux <[EMAIL PROTECTED]> wrote:
The easiest way to do it would be to prepend the following to your rules file:I would like to apply rules to a machine with currently no rules enabled. How can I do this without breaking all the current connections ?
pass in quick on ${INT} proto tcp all flags A/SA keep state keep frags
[ Add additional rules for each interface ]
[ Insert your rules here ]
This will add all existing TCP connections to your state table. You could do a similar rule for UDP.
Install your new filter rules, and let the system run that way for however long you wish. All TCP connections that have traffic during this time period will have state entries created. Note that while you're in this state, the system is only sort-of secure.
Remove the special rules. The state table will allow existing connections (that weren't idle) to continue.
--
Carson
