Re: iptables restart hangs

From: Nathaniel Hall (halln_at_otc.edu)
Date: 02/23/05

  • Next message: Thomas Cameron: "Re: Samba Question -- Users cannot access home directories" 
    Date: Wed, 23 Feb 2005 09:34:24 -0600
To: For users of Fedora Core releases <fedora-list@redhat.com>

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Aleksandar Milivojevic wrote:
    | Bernd Radinger wrote:
    |
    |> in /etc/sysconfig/iptables-config change the configuration to:
    |>
    |> IPTABLES_MODULES_UNLOAD="no"
    |>
    |> I was told that fixes the problem
    |
    |
    | It probably will, since he was hanging on module unload. It will also
    | preserve connection tracking information. However, even with that
    | option set, "iptables restart" will still flush all rules, set default
    | policy to accept, and than start firewall from scratch (so you will be
    | wide open for that small time window, enough for a packet or two to pass
    | by, which is sometimes all it takes to brake into the machine). It is
    | usually better to simply load new rules. And you can't use "iptables
    | start" either, because it is doing the same thing (basically, "start"
    | and "restart" are effectivly the same, with "restart" having an option
    | to save fw rules before stopping the firewall).
    |
    | I've raised some concerns some time ago on bugzilla about iptables
    | script and proposed (if I remember correctly) that either "start"
    | shouldn't be unloading firewall rules, or that new option for "restart"
    | be implemented (that would only load new rules). I was told that
    | there's no value in doing that since time window is too small (not
    | really, if firewall is under attack from inside and (inside) attacker
    | can guess aprox. time when firewall is to be restarted), and to modify
    | my local iptables scripts if I don't like the way it is currently done.
    |

    While the time to restart iptables is not very high, I do agree that
    something should be added to the restart script. Would there really be
    a huge problem with adding reload to the script? I know I usually have
    a problem restarting a firewall through SSH when I am translating ports.
    ~ I ssh to a different port than 22, but prerouting rules translate it to
    22. When I restart while using ssh, I get kicked out if it is a large
    ruleset. If it is a small ruleset, I am fine. My only other option is
    to be at the local console to restart iptables. If reload was an option
    so that connections were not broken, that would help a lot.

    - --

    Nathaniel Hall, GSEC
    Intrusion Detection and Firewall Technician
    Ozarks Technical Community College -- Office of Computer Networking

    halln@otc.edu
    417-447-7535
    GPG Public Key ID: 0xAC187312
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.3 (MingW32)

    iD8DBQFCHKKAc+QrUawYcxIRAiqKAJ9VpAH8KagMAEOp10DZQt1DXVfafQCbBNck
    oQLf+w3w9kgzpgVe+HVXNqI=
    =hHGR
    -----END PGP SIGNATURE----- 

    -- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: Thomas Cameron: "Re: Samba Question -- Users cannot access home directories"

    Relevant Pages

    • Re: Bit Twister: Is this the dhclient-exit-hooks you were talking about?
      ... You change the script to do what you want it to do. ... firewall, but what you show here would pretty much bypass everything you ... # dhclient-script for Linux. ... wgets and then restart my firewall. ...
      (alt.os.linux)
    • iptables script migration from Red Hat 9 To Fedora Core 4
      ... I'm working towards replacing an old firewall box with a new one. ... old box runs Red Hat Linux 9. ... I have an iptables script that works well ...
      (Fedora)
    • Firewall Rules Summary
      ... Subject: Firewall Rules Summary ... This script is provided "as is" with no implied warranty. ... this came from various howtos and articles on iptables that existed around ... #specific port denies>1024 tcp ...
      (Focus-Linux)
    • Re: [opensuse] IP tables - DIY
      ... At that time there was little YaST for the firewall, and I worked with the config file directly. ... Not knowing how IP-Filters work, it was not clear to me what exactly is happening in my firewall. ... I learnt to list the kernel IP-Table (iptables -nL), and was totally clueless what I saw there and how all this works. ... A friend came over and gave me 2-3 hours of tutoring on kernel IP-Filtering while we wrote a complete script for my network with a VPN included in the rules. ...
      (SuSE)
    • Re: iptables restart hangs
      ... option set, "iptables restart" will still flush all rules, set default ... wide open for that small time window, enough for a packet or two to pass ... And you can't use "iptables ... to save fw rules before stopping the firewall). ...
      (Fedora)