Date: Fri, 23 May 2003 23:13:59 +0200 From: David Landgren <david@landgren.net> To: Giorgos Keramidas <keramida@ceid.upatras.gr> Cc: freebsd-questions@freebsd.org Subject: Re: Update Firewall Rules Message-ID: <3ECE8F17.8010504@landgren.net> In-Reply-To: <20030522093058.GA24261@igloo.linux.gr> References: <Sea1-F44bF503zJLTz7000278e4@hotmail.com> <20030522093058.GA24261@igloo.linux.gr>
next in thread | previous in thread | raw e-mail | index | archive | help
Giorgos Keramidas wrote: > Doing thing on a remote machine that you cannot possibly access if > something goes wrong (i.e. a collcation server) is probably not a good > idea though. In cases like these, I usually follow the following > procedure when tinkering with firewall rules to avoid locking myself > out of a machine I can't login to afterwards: > > a) Schedule a reboot in 15 minutes or so. > > b) Load new firewall rules. > > c) Test rules. > > d) Unschedule the reboot if all goes well. That's a little bit savage. I hate rebooting machines if I'm not around to nurse them. People leaving bootable CDs in the drive, or floppies, bootable or otherwise, or configs that drift so that ssh fails to start up, or after the last ISP switch you forgot to set the defaultrouter to the new one... I've had all these things happen over the years. The ipfw man page has an excellent example that shows you have to create a set of rules, enable them and if you don't hit ^C in 15 seconds (or whatever time you need to test), it backs the set out and you retrieve your initial ruleset. I have used this approach on a couple of occasions, and it's very handy. Check the man page. David
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3ECE8F17.8010504>