On Sun, Oct 11, 2015 at 11:26 PM, Tom Eastep <[email protected]> wrote:
I would rather you used ?if...?else...?endif to conditionally include/exclude features. That's already supported. > That's not exactly the same in this case because I don't want/need to rely on a condition for some rules. Example : From time to time, we have meeting events at the office and some always-on-the-road people come back for few days. They need special acces and some of the Shorewall rules they need span accross sections in "rules" file. With the ?INCLUDE statement I described earlier, it would be a simple matter of commenting in or out a single entry in the main "rules" file and reloading Shorewall. Currently, I have to dig through the entire "rules" file to poke here and there to (un)comment what's necessary for these events which is far from convenient and even worse, prone to errors (by forgetting to change an entry). I fail to see how ?IF.. ?ELSE..?ENDIF statements would help in my case as there's no special usable pattern to trigger these configs with. Another example : I have a special VM to test new stuff and procedures. This VM is only started when needed, not all the time. When it's turned off, I don't want the (very permissive) rules that applies to this VM to still be active. Again, a simple "comment + reload" is easy enough to toggle the traffic permissions. That's where the ?INCLUDE which merges the rules in order come really handy. -- ObNox
------------------------------------------------------------------------------
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
