From c4b18c8e96e2a41196610600735d3cda7fbc44a0 Mon Sep 17 00:00:00 2001 From: "Brian J. Murrell" Date: Fri, 1 Mar 2019 06:27:44 -0500 Subject: Shorewall: start and enable interfaces all in hotplug Using shorewall-lite {en|dis}able instead of completely restarting Shorewall is much more efficient. But it also makes sense to move the starting of Shorewall from init to an interface hotplug event. The "lan" interface should be a good indicator that networking it ready. Besides, Shorewall won't start until br-lan is available. Signed-off-by: Brian J. Murrell --- net/shorewall6/files/hotplug_iface | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'net/shorewall6/files') diff --git a/net/shorewall6/files/hotplug_iface b/net/shorewall6/files/hotplug_iface index aaa03e8a9..bfe2bf7b1 100644 --- a/net/shorewall6/files/hotplug_iface +++ b/net/shorewall6/files/hotplug_iface @@ -1,13 +1,19 @@ #!/bin/sh -# should restart shorewall when an interface comes up +DEVICE=${DEVICE:-$(/sbin/uci -p /var/state get network."$INTERFACE".ifname)} case "$ACTION" in ifup) - /etc/init.d/shorewall6 restart + if [ "$INTERFACE" = "lan" ]; then + /usr/sbin/shorewall -6 start + elif [ "${INTERFACE:0:3}" = "wan" ] && + [ "${INTERFACE:$((${#INTERFACE}-2)):2}" != "_6" ]; then + /etc/shorewall6/state/firewall enable "$DEVICE" + fi ;; ifdown) - # might need to restore some routing - /etc/init.d/shorewall6 restart + if [ "${INTERFACE:0:3}" = "wan" ]; then + /etc/shorewall6/state/firewall disable "$DEVICE" + fi ;; esac -- cgit v1.2.3