From 5830b90f4b0b15572dbb091af69f42431c4cdbaa Mon Sep 17 00:00:00 2001 From: Kristof Provost Date: Wed, 28 Feb 2018 08:53:07 +0000 Subject: [PATCH] pf: Do not flush on reload pfctl only takes the last '-F' argument into account, so this never did what was intended. Moreover, there is no reason to flush rules before reloading, because pf keeps track of the rule which created a given state. That means that existing connections will keep being processed according to the rule which originally created them. Simply reloading the (new) rules suffices. The new rules will apply to new connections. PR: 127814 Submitted by: Andreas Longwitz MFC after: 3 weeks --- etc/rc.d/pf | 3 --- 1 file changed, 3 deletions(-) diff --git a/etc/rc.d/pf b/etc/rc.d/pf index cab7d8ee9eae..1811abd8498d 100755 --- a/etc/rc.d/pf +++ b/etc/rc.d/pf @@ -54,9 +54,6 @@ pf_reload() { echo "Reloading pf rules." $pf_program -n -f "$pf_rules" || return 1 - # Flush everything but existing state entries that way when - # rules are read in, it doesn't break established connections. - $pf_program -Fnat -Fqueue -Frules -FSources -Finfo -FTables -Fosfp > /dev/null 2>&1 $pf_program -f "$pf_rules" $pf_flags }