diff options
| author | Stig Thormodsrud <stig@vyatta.com> | 2010-03-05 11:24:33 -0800 |
|---|---|---|
| committer | Stig Thormodsrud <stig@vyatta.com> | 2010-03-05 11:24:33 -0800 |
| commit | 31a37e48a3095c64aca1a3fd3a0f46ca115dc767 (patch) | |
| tree | 2ac8a471f3014a7e52030b037b28934eacc448df /scripts | |
| parent | 175dee3f55a177df91a896071510bcf39d23f3d0 (diff) | |
| download | vyatta-cfg-firewall-31a37e48a3095c64aca1a3fd3a0f46ca115dc767.tar.gz vyatta-cfg-firewall-31a37e48a3095c64aca1a3fd3a0f46ca115dc767.zip | |
Fix firewall conntrack teardown.
Diffstat (limited to 'scripts')
| -rwxr-xr-x | scripts/firewall/vyatta-firewall.pl | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/scripts/firewall/vyatta-firewall.pl b/scripts/firewall/vyatta-firewall.pl index 95c0198..1961541 100755 --- a/scripts/firewall/vyatta-firewall.pl +++ b/scripts/firewall/vyatta-firewall.pl @@ -179,13 +179,15 @@ if (defined $teardown) { # remove the conntrack setup. my $num; - $num = find_chain_rule($iptables_cmd, 'raw', 'PREROUTING', 'FW_CONNTRACK'); - if (defined $num and ! is_tree_in_use($other_tree{$teardown})) { - run_cmd("$iptables_cmd -t raw -D PREROUTING $num", 1, 1); - run_cmd("$iptables_cmd -t raw -D OUTPUT $num", 1, 1); - run_cmd("$iptables_cmd -t raw -F FW_CONNTRACK", 1, 1); - run_cmd("$iptables_cmd -t raw -X FW_CONNTRACK", 1, 1); + foreach my $label ('PREROUTING', 'OUTPUT') { + $num = find_chain_rule($iptables_cmd, 'raw', $label, 'FW_CONNTRACK'); + if (defined $num and ! is_tree_in_use($other_tree{$teardown})) { + run_cmd("$iptables_cmd -t raw -D $label $num", 1, 1); + } } + run_cmd("$iptables_cmd -t raw -F FW_CONNTRACK", 1, 1); + run_cmd("$iptables_cmd -t raw -X FW_CONNTRACK", 1, 1); + exit 0; } |