4 ms·
Yep, the most common way I've lost access to machines is by messing up the iptables/ipfw rules. Read a post here about avoiding that by having a timed reset wit
by isatty 6y ago
Yep, the most common way I've lost access to machines is by messing up the iptables/ipfw rules. Read a post here about avoiding that by having a timed reset with sleep.
- leoh 6y agoLink?
- oars 6y agoThis has happened to me as well. Where could I read about this method?
- lazyant 6y agoFor people asking: you can create a resetfw.sh script, for iptables: #!/bin/bash iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT iptables -t nat -F iptables -t mangle -F iptables -F iptables -X chmod +x resetfw.sh and add it for ex to /etc/cron.hourly directory This way you can test your iptables rules and they'll get clear at every hour. Once you check they are OK you can delete this cronjob. (NOTE: I'm typing from memory, haven't tested this)
- metiscus 6y agoYou might add a daily task to remove that task just in case you forget. That way you avoid lockout but don't end up opening yourself up accidentally.
- taftster 6y agoOr possibly just turn iptables off, in the same cron.hourly.
- lazyant 6y agoAh yes, that's simpler: systemctl stop iptables. Also need to do systemctl disable iptables just in case, otherwise if the server reboots the iptables service will restart.
- benedikt 6y agohttps://manpages.debian.org/stretch/iptables/iptables-apply.8.en.html https://manpages.debian.org/stretch/iptables/iptables-apply.... Or use `at` to run `iptables-restore`. Simpler than setting up a cronjob (and if youre doing it manually, cron has a bunch of gotchas that at least bite me in the ass once in a blue moon).
- lazyant 6y agoYes. Although iirc (it may have changed, haven't looked "recently" the iptable- commands are distro specific, as in not all of them have / had them).