Nginx – Experience in migrating from Apache to nginx

I'd recommend against options IPFIREWALL_DEFAULT_TO_ACCEPT. The default is to Default to Deny. The firewall comes up with just one rule deny ip from any to any and stays that way until a script configures exactly what traffic should get through.

Follow-Up Note: RSA (one of the world's leading security technology companies) was hacked recently when part of their firewall was disabled during a maintenance window. This really underscores how quickly a system can be compromised given the right conditions.

If you insist on disabling the firewall until you explicitly block unwanted traffic, please consider using the sysctl available by adding net.inet.ip.fw.default_to_accept=1 to loader.conf. This has the added benefit of being easily modified (no recompiling the kernel) if you change your mind at some point in the future.

If you want to shutdown the local apache site letting the current users finish their current task do a graceful Apache stop. I'll presume that you have some other architecture that would redirect users to another operational website to allow them to continue (i.e. load balancer, etc).

From the Apache site:

Signal: WINCH apachectl -k graceful-stop

" The WINCH or graceful-stop signal causes the parent process to advise the children to exit after their current request (or to exit immediately if they're not serving anything). The parent will then remove its PidFile and cease listening on all ports. The parent will continue to run, and monitor children which are handling requests. Once all children have finalised and exited or the timeout specified by the GracefulShutdownTimeout has been reached, the parent will also exit. If the timeout is reached, any remaining children will be sent the TERM signal to force them to exit.

A TERM signal will immediately terminate the parent process and all children when in the "graceful" state. However as the PidFile will have been removed, you will not be able to use apachectl or httpd to send this signal. "