Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Shall I flush iptables rules for specific interface if this interface went down?
Does it offer any advantages?

Currently I'm using iptables-restore and I am not deleting rules, even if I sent interface down, rules are just loaded upon boot-up and that's all.

What do you recommended?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I wouldn't bother. There might be some edge cases were it could matter to the FW performance (for example if you have thousands of rules, complex fwmarks etc. running for an unused interface).

I have implemented highly available firewalls using vlans, heartbeat, and iptables. In that case, the standby firewall has all of the rules loaded, even though it has none of the IPs (we do create the vlan devices ahead of time though.)

Besides, if you load all your FW rules from one script and then flush only the rules for a single interface you will have to reload all your rules to restore the interface. This will interrupt your established connections unnecessarily.

share|improve this answer

I don't think it's necessary. Also, if you use a DROP policy and flush the wrong thing you can end locked out of the server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.