Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know this is a real newbie question but what does it mean when someone says they "flushed the firewall". I got locked out of my server a few times due to the enhanced security configuration I had done and when I contacted my server management company, they said both times that they flushed the firewall and I was allowed back in.

I hope "flushing the firewall" doesn't mean they reduced the security settings at all.

share|improve this question
3  
Sounds to me like they were just making stuff up to cover their own mistake. I do this regularly. –  Mark Henderson Oct 15 '09 at 23:30
2  
This is one case where it might be better to ask them what they meant rather than asking us to guess. –  RobM Oct 16 '09 at 13:51

8 Answers 8

If you talk about a firewall software like, iptables, pf, ipfw ...
I think that flush the firewall means remove all firewall rules

share|improve this answer

I don't really believe there is a very clear definition of what exactly they mean. They could be specifically referring to a function of something that is part of iptables, or they could just be using the word flush as a somewhat generic term to mean something like restart/reboot.

I think they may man something like:

  • Removing all firewall rules, and then adding them back.
    • Sometimes this may be necessary if you have a process that dynamically adds/changes rules.
    • If you use DNS names in firewall rules, this may be necessary after the DNS has been changed.
    • (On Linux based systems the DNS name is resolved when the rule is added to the kernel tables, not each time a packet arrives.)
  • Remove all firewall state data. Firewalls these days must track the state of every connection passing through it. Perhaps they are simply clearing out all the state information.
  • Only, clearing out any rules automatically created by a Intrusion Prevention System.
    • If the system was using something like fail2ban or something else login failures can result in a firewall rule being added to explicitly block connections for the IP address you are trying to connect from.
  • Restart any Application Level Proxies/Gateways. To clear out any cache session state or resolve bugs in the application.

You could simply ask them what exactly they mean by flush. They should be able to provide a good answer about exactly what they mean. If they can't provide a reason why it should fix the issue you are having, or at least a plausible theory, then you may want to consider getting a second opinion.

share|improve this answer
    
Almost certainly: Clear out any rules automatically created by a Intrusion Prevention System (unless the administrator is making up verbiage). –  Joe Oct 15 '09 at 23:39
    
Yep, I need to do this from time to time when but I've never thought of giving it a name. I suppose this could be called "confusion through obscurity". :) –  John Gardeniers Oct 16 '09 at 0:11
    
+1 for "simply ask them" –  Tarnay Kálmán Oct 16 '09 at 0:56

It could mean clearing and re-adding rules as Zoredache and mezgani have noted. It could also mean flushing the state table, e.g. clearing out all of the NAT/PAT mappings. If the administrator is naive it could mean rebooting.

share|improve this answer

Flushing the firewall refers to sending instructions to the flux capacitors with parameters to release all galamars, which allows new gizfreids to be established, without deteriorating the Brithair System's integrity.

Any questions?

share|improve this answer

if it's linux, most likely it's iptables -F

man iptables:

   -F, --flush [chain]
          Flush the selected chain (all the chains in the table if none is
          given).  This is equivalent to deleting all  the  rules  one  by
          one.
share|improve this answer
    
That may be where the word they are using came from, but I doubt that they mean they are just flushing all the rules, and not adding anything back. –  Zoredache Oct 16 '09 at 0:27

for easy understanding, to flush = to reset, to turn setting off and then on... flush firewall = remove all rules and then reset them

share|improve this answer

It might be the case that they had an excessive level of logging enabled and the logs just filled up all available space, thereby deteriorating performance and/or causing the firewall to deny everything as a panic reaction to not being able to log, and hence the logs needed to be flushed in order to reclaim the space.

But I agree that it sounds more like they're making up techie-seeming jargon to cover themselves.

share|improve this answer

I think we may be overcomplicating things. The first thing that pops to mind is flushing the DNS cache - similar to when you ipconfig/fushdns on a Windows box.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.