2

I know this is a real newbie question but what does it mean when someone says they "flushed the firewall". I got locked out of my server a few times due to the enhanced security configuration I had done and when I contacted my server management company, they said both times that they flushed the firewall and I was allowed back in.

I hope "flushing the firewall" doesn't mean they reduced the security settings at all.

2
  • 3
    Sounds to me like they were just making stuff up to cover their own mistake. I do this regularly. Oct 15, 2009 at 23:30
  • 2
    This is one case where it might be better to ask them what they meant rather than asking us to guess.
    – Rob Moir
    Oct 16, 2009 at 13:51

8 Answers 8

7

I don't really believe there is a very clear definition of what exactly they mean. They could be specifically referring to a function of something that is part of iptables, or they could just be using the word flush as a somewhat generic term to mean something like restart/reboot.

I think they may man something like:

  • Removing all firewall rules, and then adding them back.
    • Sometimes this may be necessary if you have a process that dynamically adds/changes rules.
    • If you use DNS names in firewall rules, this may be necessary after the DNS has been changed.
    • (On Linux based systems the DNS name is resolved when the rule is added to the kernel tables, not each time a packet arrives.)
  • Remove all firewall state data. Firewalls these days must track the state of every connection passing through it. Perhaps they are simply clearing out all the state information.
  • Only, clearing out any rules automatically created by a Intrusion Prevention System.
    • If the system was using something like fail2ban or something else login failures can result in a firewall rule being added to explicitly block connections for the IP address you are trying to connect from.
  • Restart any Application Level Proxies/Gateways. To clear out any cache session state or resolve bugs in the application.

You could simply ask them what exactly they mean by flush. They should be able to provide a good answer about exactly what they mean. If they can't provide a reason why it should fix the issue you are having, or at least a plausible theory, then you may want to consider getting a second opinion.

3
  • Almost certainly: Clear out any rules automatically created by a Intrusion Prevention System (unless the administrator is making up verbiage).
    – Joe
    Oct 15, 2009 at 23:39
  • Yep, I need to do this from time to time when but I've never thought of giving it a name. I suppose this could be called "confusion through obscurity". :) Oct 16, 2009 at 0:11
  • +1 for "simply ask them" Oct 16, 2009 at 0:56
2

if it's linux, most likely it's iptables -F

man iptables:

   -F, --flush [chain]
          Flush the selected chain (all the chains in the table if none is
          given).  This is equivalent to deleting all  the  rules  one  by
          one.
1
  • That may be where the word they are using came from, but I doubt that they mean they are just flushing all the rules, and not adding anything back.
    – Zoredache
    Oct 16, 2009 at 0:27
1

It could mean clearing and re-adding rules as Zoredache and mezgani have noted. It could also mean flushing the state table, e.g. clearing out all of the NAT/PAT mappings. If the administrator is naive it could mean rebooting.

0

If you talk about a firewall software like, iptables, pf, ipfw ...
I think that flush the firewall means remove all firewall rules

0

Flushing the firewall refers to sending instructions to the flux capacitors with parameters to release all galamars, which allows new gizfreids to be established, without deteriorating the Brithair System's integrity.

Any questions?

0

for easy understanding, to flush = to reset, to turn setting off and then on... flush firewall = remove all rules and then reset them

0

It might be the case that they had an excessive level of logging enabled and the logs just filled up all available space, thereby deteriorating performance and/or causing the firewall to deny everything as a panic reaction to not being able to log, and hence the logs needed to be flushed in order to reclaim the space.

But I agree that it sounds more like they're making up techie-seeming jargon to cover themselves.

0

I think we may be overcomplicating things. The first thing that pops to mind is flushing the DNS cache - similar to when you ipconfig/fushdns on a Windows box.

You must log in to answer this question.