How to Activate a Different or Updated Packet Filtering Rule Set

Use the following procedure if you want to perform either of the following tasks:

• Activate a packet filtering rule set other than the one that is currently in use by Solaris IP Filter.

• Reload the same filtering rule set that has been newly updated.

1. Assume a role that includes the IP Filter Management rights profile, or become superuser.

   You can assign the IP Filter Management rights profile to a role that you create. To create the role and assign the role to a user, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Choose one of the following steps:

   • Create a new rule set in a separate file of your choice if you want to activate an entirely different rule set.

   • Update the current rule set by editing the configuration file that contains that rule set.

3. Remove the current rule set and load the new rule set.

   # ipf -Fa -f filename

   The filename can either be the new file with the new rule set or the updated file that contains the active rule set.

   The active rule set is removed from the kernel. The rules in the filename file become the active rule set.

   ---

   Note –

   You still need to issue the command even if you are reloading the current configuration file. Otherwise, the old rule set continues to be operative, and the modified rule set in the updated configuration file is not applied.

   Do not use commands such as ipf -D or svcadm restart to load the updated rule set. Such commands expose your network by disabling the firewall first before loading the new rule set.

   ---

Example 25–3 Activating a Different Packet Filtering Rule Set

The following example shows how to replace one packet filtering rule set with another packet filtering rule set in a separate configuration file, /etc/ipf/ipf.conf.

# ipfstat -io
empty list for ipfilter(out)
pass in quick on dmfe all
# ipf -Fa -f /etc/ipf/ipf.conf
# ipfstat -io
empty list for ipfilter(out)
block in log quick from 10.0.0.0/8 to any

Example 25–4 Reloading an Updated Packet Filtering Rule Set

The following example shows how to reload a packet filtering rule set that is currently active and which is then updated. In this example, the file in use is /etc/ipf/ipf.conf.

# ipfstat -io (Optional)
empty list for ipfilter (out)
block in log quick from 10.0.0.0/8 to any

(Edit the /etc/ipf/ipf.conf configuration file.)

# ip -Fa -f /etc/ipf/ipf.conf
# ipfstat -io (Optional)
empty list for ipfilter (out)
block in log quick from 10.0.0.0/8 to any
block in quick on elx10 from 192.168.0.0/12 to any