14

As I'm learning about iptables I've made a couple of mistakes and locked myself out.

What method(s) do you use to test rules without locking yourself out?

I'm using ubuntu server 12.04 LTS


All the answers below were helpful. In the end I used a combination of options. It also helps to have IPMI access to your remote server just in case! But ideally test the rules locally on a replicated environment and test that first. Vagrant helps in this regard to get test setups working quickly.

17

iptables-apply is specifically designed for this. It applies your rules, and then prompts you to affirm. If you don't affirm, it rolls them back out. So if you brick the system or lock yourself out with apply, it rolls back.

7

What method(s) do you use to test rules without locking yourself out?

Think about the effect of what you're typing before you type it.

locked myself out

Before you start changing things remotely that might lock you out, insert an accept rule matching your connection at the start of the list. Back that up with a watchdog script that will reset all the rules to what was working when you started if you don't reset the timer. You can do that with a file monitoring loop and running the touch command to reset the timestamp while you're working on things. Just remember to turn it off when you finalize the rules. The very simple format of that is:

sleep $((10*60)) && iptables-restore /path/to/working/script
  • 2
    sleep 10m works, too :) – melsayed Nov 22 '12 at 6:43
  • Though the OP asked for Ubuntu and thus the answer to 'iptables-apply' would be ideal (for any debian hybrids), for other distros such as Fedora which doesn't have 'iptables-apply', I prefer/appreciate this method/practice/suggestion. – HidekiAI Dec 22 '16 at 19:40
3

You can setup iptables without a default DROP rule on your input-chain. If you create a rule and then put in this command:

$ iptables -nvL

Then you see packet counts and see if you have hits from your host.

Also another option is, is to make a crontab that runs a script. Within that script, you can write

$ iptables -F

With this command you can flush your IPTABLES-config.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.