Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Even the greatest of minds make mistakes;

If I make a mistake on a remote server in my stored iptables rules that are loaded at start up, then next time the machine restarts I'm locked out.

So, say in a sleepy state I put an extra dot in an IP address, this error causes iptables to just freak out and drop all traffic, rules prior to this one are ignore, it just does nothing which is useless to me.

Can I make it just fail open or something if there is an error?

share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

Yes, when making changes to your iptables configuration always put something in cron that will restore them to a sane state every 10 minutes (or whatever).

share|improve this answer
    
I do think about this, but everytime I make a change on any server I would have to first make a copy of the current rules, then add a cron job, make the change, then remove the cron job again. Bit much when making simple rule changes. Does iptables really not have any sort of option to not shit the bed, in the rather stupid fasion that is does, in the event of simple human error? –  jwbensley Jan 6 '12 at 10:02
1  
I don't think it has that option. I have a script that just sets a simple sane configuration every 10 minutes that would allow me back in. Takes 10 seconds to uncomment and I know I'm safe. –  Iain Jan 6 '12 at 10:17
    
@javano "Don't make errors". Software does not exist to protect us from ourselves, it exists to do what we tell it to. If you expect to make an error (you're human, you should expect this) it's up to you to create an appropriate backout plan, such as the cron job Iain suggested... –  voretaq7 Jan 7 '12 at 0:23
add comment

iptables follows whatever instructions you give it. A incorrectly formatted argument won't cause iptables to dump all it's rules... (i.e. an extra . someplace...) but an incorrect rule that is valid... will certainly be problematic... including dump all traffic... or accept everything.

i.e. valid statements that are probably bad include:

iptables -I INPUT -j ACCEPT
iptables -I INPUT -s 0.0.0.0/0 -j ACCEPT

or

iptables -I INPUT -j DROP

or even

iptables -F

but a rule like

iptables -I INPUT -s 192.168..11 -j ACCEPT

should spit out an error. The only time one or more rules get "deleted" or "removed" are when you flush a table (-F), delete a rule (-D) or delete a chain (-X). As long as you're not messing with those 3 options... you can always delete the bad rule & move on.

share|improve this answer
    
This is OK if you are typing commands in one at a time. I'm talking about at system start up, the iptables rules are restored from a saved config, it has many lines in it, if one of them is wrong, the whole thing falls over. –  jwbensley Jan 6 '12 at 10:00
    
Saving/restoring iptables rules is not something iptables does by itself. Depending on the distribution you're using... they may have built in scripts that will save on start/shutdown... but imho... that isn't a very good idea. Still... even if one line is bad... it still should not have problems ignoring that one line & moving on. –  TheCompWiz Jan 6 '12 at 14:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.