Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was setting up my iptables when I performed a iptables -F and my ssh pipe broke.

This is the last output of my session:

root@alfapaints:~# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             state NEW,ESTABLISHED tcp dpt:2222
ACCEPT     tcp  --  li465-68.members.linode.com  anywhere             state NEW,ESTABLISHED tcp dpt:nrpe
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:9200 state NEW,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http state NEW,ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere             udp spt:domain

Chain FORWARD (policy DROP)
target     prot opt source               destination             

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             state ESTABLISHED tcp spt:2222
ACCEPT     tcp  --  anywhere             anywhere             state ESTABLISHED tcp spt:nrpe
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:9200 state ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:http state ESTABLISHED
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
root@alfapaints:~# iptables -F
Write failed: Broken pipe

I tested my connection just before and I was able to connect with ssh. Now I did a nmap scan and not a single port is open anymore. I know my VPS is running on VMWare ESXi, could a reboot help?

Or if not could I attach and mount the disk to another vm to save the data?

Does anybody have some advise? And maybe an explanation what happend or what could have cause my pipe to break?

ps: I didn't save my rules on the config directories of iptables. But used a file I stored in ~/rules.config to apply my rules like this: iptables-restore < rules.config So probably a reboot would help?

Thanks a lot in advance.

share|improve this question
    
Full ACK to MadHatter's answer. What's about management access to your virtual machine? No backdoor? Noone that can boot the machine in single user mode and flush your iptables (the 'right' way..)? –  Michuelnik Aug 29 '12 at 21:02
    
May I politely recommend that you not publicize hosts that aren't ready for prime-time? –  Joel E Salas Aug 29 '12 at 21:25
add comment

2 Answers

All three of your policies are DROP, so by flushing the chains, you've removed all the rules which might modify the disposition of particular packets, and left them all to the default policies: effectively, you've said that all packets in, out and through the machine should be discarded.

Whether a reboot will help will depend on what your machine's startup state is. If you've got a sensible set of rules designed to come up on reboot, then reboot it. If on the other hand you've got the reboot code set up to save and restore the running firewall state on reboot, or you have a highly-restrictive set of startup rules, then the reboot won't help.

Assuming you get it back, something I find that helps often when working on iptables rules is

at now+5min
 service iptables stop
 ^D

This has saved me quite often when trying to do something clever. I can stuff up and lock myself out, knowing that in five minutes the firewalls will come down, and I can get back in and set things to rights.

share|improve this answer
    
Use iptables-save, iptables-restore and IPTABLES-APPLY! :D –  Michuelnik Aug 29 '12 at 21:00
add comment

You appear to be using Linode. In this case, use the Linode Shell to gain access to the console of your virtual machine. You can then login and repair your firewall.

Using some other provider, the provider can give you equivalent virtual console access. VMware is perfectly capable of this, for instance.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.