I got a quite complicated firewall (8 segments) and sometimes I need to reload rules and add some new vlans. I'd like to quiet the traffic for few seconds while new rules are loaded. I.e. I want all outgoing traffic be dropped (but without killing existing conntrack rules).
I tried the following rule:
iptables -t raw -N __just_drop
iptables -t raw -I PREROUTING 1 -j __just_drop
iptables -t raw -I OUTPUT 1 -j __just_drop
Now atomically silent the network:
iptables -t raw -A __just_drop -j DROP
Now, do your stuff, start/stop interfaces, configure vlans and bondings and reconfigure iptables rules. Then atomically unblock the network:
iptables -t raw -F __just_drop
# clean up
iptables -t raw -D PREROUTING -j __just_drop
iptables -t raw -D OUTPUT -j __just_drop
iptables -t raw -X __just_drop
but it appears that silencing the network that way doesn't work. It almost work but still some protocols, like DHCP, pass through. What did I wrong and is there a way to global DROP of the whole network without affecting conntrack? I.e. I'm looking the way to simulated pull the interfaces' cables out.
