[CentOS-docs] Re: IPTables HowTo (Comment)

[Manuel Wolfshant]

Ned Slider wrote:
> Daniel Swid wrote:
>> Hi,
>> Was following along reading your how-to with a box I had ssh'd to. I 
>> started
>> pasting in the commands to build my own filter and my computer 
>> connection
>> suddenly stopped responding after I pasted in
>>
>> iptables -P INPUT DROP
>>
>> Thought it'd be good of you to add a little warning next to that 
>> line....
>>
>> Cheers,
>> Daniel
>>
>
> Hi Daniel,
>
> Thanks for your comments and you raise a good point. I'll look to 
> adding a comment to address that issue.
>
> I guess the best solution would be to develop and test your script 
> locally before uploading and deploying on a remote server. 
> Alternatively, if you must test remotely, setting up a cronjob to 
> deactivate the firewall after 5 mins is a popular approach to prevent 
> locking yourself out of your machine (if anyone on the list has any 
> thoughts about this, it would be appreciated??)
Oh, yes, please add a note about "at now + 5 minutes pretty please 
disable firewall". It's simple, effective, useful. Safety nets are needed.



As I had my fair part of cutting my access to remote machines via "well 
designed" firewall rules, I have settled for the following
- whitelist the IPs I connect from at the very beginning of the firewall 
script
- rather than rely on default policy being DROP, I prefer to let it on 
ACCEPT but end the script with:

    echo log stuff
    $IPT -A FORWARD -j LOG --log-prefix "blocked in forward "
    $IPT -A INPUT -j LOG -m limit --limit 20/m --log-prefix "blocked in
    input "
    $IPT -A OUTPUT -j LOG -m limit --limit 20/m --log-prefix "blocked in
    output "

    echo almost fascist drop
    $IPT -A FORWARD -j REJECT
    $IPT -A INPUT -j REJECT
    $IPT -A OUTPUT -j REJECT


Ned: I suggest to insert a line after the "-P DROP" to warn people that 
this command will cut access from remote sites unless a previous ACCEPT 
rule already exists. . So either upload and test a full script, or work 
locally.... or take care :)