remove ipsets when firewall disabled

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 70d916c48a3f2e667fec651b5d7635db8ae2845a..22cae5a8c7ee50eafe1073f063339837353d1199 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2781,6 +2781,8 @@ sub compile {
 
     push @{$cluster_conf->{ipset}->{management}}, { cidr => $localnet };
 
+    return ({}, {}) if !$cluster_conf->{options}->{enable};
+
     my $ruleset = {};
 
     ruleset_create_chain($ruleset, "PVEFW-INPUT");
@@ -2969,8 +2971,9 @@ sub get_ruleset_cmdlist {
     }
 
     foreach my $h (qw(INPUT OUTPUT FORWARD)) {
-       if (!$hooks->{$h}) {
-           $cmdlist .= "-A $h -j PVEFW-$h\n";
+       my $chain = "PVEFW-$h";
+       if ($ruleset->{$chain} && !$hooks->{$h}) {
+           $cmdlist .= "-A $h -j $chain\n";
        }
     }
 
@@ -3170,6 +3173,17 @@ sub remove_pvefw_chains {
     $cmdlist .= "COMMIT\n";
 
     iptables_restore_cmdlist($cmdlist);
+
+    my $ipset_chains = ipset_get_chains();
+
+    $cmdlist = "";
+ 
+    foreach my $chain (keys %$ipset_chains) {
+       $cmdlist .= "flush $chain\n";
+       $cmdlist .= "destroy $chain\n";
+    }
+
+    ipset_restore_cmdlist($cmdlist) if $cmdlist; 
 }
 
 sub init {
@@ -3188,11 +3202,7 @@ sub update {
        my $cluster_conf = load_clusterfw_conf();
        my $cluster_options = $cluster_conf->{options};
 
-       my $enable = $cluster_options->{enable};
-
-       die "Firewall is disabled - cannot start\n" if !$enable;
-
-       if (!$enable) {
+       if (!$cluster_options->{enable}) {
            PVE::Firewall::remove_pvefw_chains();
            return;
        }