0

I am running a script which updates firewall rules on a Debian machine via SSH as well as other actions. However, after the script runs, my connection just hangs. I am able to close the terminal and reconnect just fine and when I reconnect, my script is still running.

Is there an equivalent to the RHEL/CentOS service iptables reload commands for Debian?

I've tried iptables-save > /etc/network/iptables then iptables-apply, but it's no good.

Improve this question
2
  • How many rules do you have in there? Do you use iptables-restore < /etc/network/iptables after doing iptables-save? What does your script look like, is it custom or an OTS solution like csf, et.al.?
    – Andrew Domaszek
    May 21, 2014 at 0:28
  • Here are my iptables rules: pastebin.com/jRTHWJqJ. I've tried changing SSH from allowing just NEW to NEW,ESTABLISHED but the problem still persists.
    – Python Novice
    May 21, 2014 at 18:52

2 Answers 2

Reset to default
0

I suspect the "service iptables reload" is roughly equivalent to your work-arround in functionality, ie the solution would not work on CentOS either.

You might want to post the rules you are using, but I suspect you will find the problem has to do with either nat or more likely reliance on "established, related" iptables rules. If its the latter, try adding a rule for your SSH connection which does not rely on that.

Another work-arround might be to use screen so that when you connect back the session continues where you left off.

If your issue is NAT, you may have some luck by running a VPN - sometime shortly after the VPN reconnects your SSH session should restore itself.

Improve this answer
3
  • On CentOS/RHEL, reload keeps connections alive while restart closes them. I read that reload is preferred from a security perspective. Here are my iptables rules: pastebin.com/jRTHWJqJ. I've tried changing SSH from allowing just NEW to NEW,ESTABLISHED but the problem still persists.
    – Python Novice
    May 21, 2014 at 18:53
  • Actually, I think you will find that iptables reload does not do anything in CentOS. Do a search for "reload" in /etc/init.d/iptables and you will see it says that reload is unimplemented and simply returns a value of 3 !!!
    – davidgo
    May 21, 2014 at 18:58
  • I've been using it just fine on CentOS and RHEL 6. I looked in that file and found nothing of the sort.
    – Python Novice
    May 21, 2014 at 23:34
0

your ssh session hanhgs because the iptables accept rule for SSH only accepts NEW connections when it should accept NEW and "ESTABLISHED"

iptables -A INPUT -p tcp -m tcp --dport 22 -m limit --limit 3/minute --limit-burst 10 -m state --state NEW -j ACCEPT
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .