Only run includes and set sysctls if either v4 or v6 firewall was actually started

diff --git a/main.c b/main.c
index 09baca9579e96e1c944080c55dff531f3c9026ca..3654c1503842929c50cafe8f84f97f404176c49a 100644 (file)
--- a/main.c
+++ b/main.c
@@ -255,8 +255,6 @@ start(struct fw3_state *state, bool reload)
 
        if (!print_rules && !reload)
        {
-               fw3_set_defaults(state);
-
                if (fw3_command_pipe(false, "ipset", "-exist", "-"))
                {
                        fw3_create_ipsets(state);
@@ -311,11 +309,16 @@ start(struct fw3_state *state, bool reload)
                rv = 0;
        }
 
-       if (!reload && !print_rules)
-               fw3_run_includes(state);
+       if (!rv)
+       {
+               fw3_set_defaults(state);
+
+               if (!reload && !print_rules)
+                       fw3_run_includes(state);
 
-       if (!rv && !print_rules)
-               fw3_write_statefile(state);
+               if (!print_rules)
+                       fw3_write_statefile(state);
+       }
 
        return rv;
 }