≡ Menu

How To Reset Linux Firewall Automatically While Testing Configuration With Remote Server Over SSH Session

I would like to tell my Linux iptables firewall to flush out the current configuration every 5 minutes. This will help when I’m testing a new rules and configuration options. Some time I find myself locked out of my own remote server. How do I reset Linux firewall automatically without issuing hard reboot?

You can easily flush out current configuration using iptables command and shell script combo. There is no built in option for this kind of settings. So you need to write a small shell script and call it from crontab file.

Create a firewall reset shell script

Create a /root/reset.fw script:

#!/bin/bash
# reset.fw - Reset firewall
# set x to 0 - No reset
# set x to 1 - Reset firewall
# ---------------------------------------------------------------------------------------------------------------
# Added support for IPV6 Firewall
# ---------------------------------------------------------------------------------------------------------------
# Written by Vivek Gite <vivek@nixcraft.com>
# ---------------------------------------------------------------------------------------------------------------
# You can copy / paste / redistribute this script under GPL version 2.0 or above
# =============================================================
x=1
 
# set to true if it is CentOS / RHEL / Fedora box
RHEL=false
 
# set true if it is CentOS/RHEL v7.x or above
RHEL7=false 
 
### no need to edit below  ###
IPT=/sbin/iptables
IPT6=/sbin/ip6tables
 
if [ "$x" == "1" ];
then
	if [ "$RHEL" == "true" ];
	then
	      # reset firewall using redhat script
               if [ "$RHEL7" == "true" ];
               then
                 systemctl stop iptables 
                 systemctl stop ip6tables 
               else  ## old rhel <= v6.x ##
		         /etc/init.d/iptables stop
		         /etc/init.d/ip6tables stop
               fi
	else
		# for all other Linux distro use following rules to reset firewall
		### reset ipv4 iptales ###
		$IPT -F
		$IPT -X
		$IPT -Z
		for table in $(</proc/net/ip_tables_names)
		do 
			$IPT -t $table -F
			$IPT -t $table -X
			$IPT -t $table -Z 
		done
		$IPT -P INPUT ACCEPT
		$IPT -P OUTPUT ACCEPT
		$IPT -P FORWARD ACCEPT
		### reset ipv6 iptales ###
		$IPT6 -F
		$IPT6 -X
		$IPT6 -Z
		for table in $(</proc/net/ip6_tables_names)
		do 
			$IPT6 -t $table -F
			$IPT6 -t $table -X
			$IPT6 -t $table -Z 
		done
		$IPT6 -P INPUT ACCEPT
		$IPT6 -P OUTPUT ACCEPT
		$IPT6 -P FORWARD ACCEPT
	fi
else
        :
fi

Set permissions:
# chmod +x /root/reset.fw
Create cronjon to reset current configuration every 5 minutes, enter
# crontab -e
OR
# vi /etc/crontab
Append following settings:
*/5 * * * * root /root/reset.fw >/dev/null 2>&1
Please remember to set x to 0 once a working configuration has been created for your Linux system.

Dealing with command line rules

Run command over screen based session:
Your-iptable-rule-here && sleep 120 && /root/reset.fw
You can load the firewall rule and sleep for 120 seconds then disable/reset firewall using /root/reset.fw script.

A note about security

Also, rather than leaving your server vulnerable, it might be good to have it restore a known good version of the tables, or one locked down to nothing but ssh:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT

For example one can update above script as follows:

...
	else
		# for all other Linux distro use following rules to reset firewall
		### reset ipv4 iptales ###
		$IPT -F
		$IPT -X
		$IPT -Z
		for table in $(</proc/net/ip_tables_names)
		do 
			$IPT -t $table -F
			$IPT -t $table -X
			$IPT -t $table -Z 
		done
		$IPT -P INPUT ACCEPT
		$IPT -P OUTPUT ACCEPT
		$IPT -P FORWARD ACCEPT
		#Uncommet to drop everything but only allow ssh over ipv4 ##
		#$IPT -P INPUT DROP
		#$IPT -P OUTPUT DROP
		#$IPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
		#$IPT -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
		### reset ipv6 iptales ###
		$IPT6 -F
		$IPT6 -X
		$IPT6 -Z
		for table in $(</proc/net/ip6_tables_names)
		do 
			$IPT6 -t $table -F
			$IPT6 -t $table -X
			$IPT6 -t $table -Z 
		done
		$IPT6 -P INPUT ACCEPT
		$IPT6 -P OUTPUT ACCEPT
		$IPT6 -P FORWARD ACCEPT
	fi
...
See also

Sysadmin because even developers need heroes!!!

Share this tutorial on:
{ 10 comments… add one }
  • Kevin Green July 6, 2008, 12:49 pm

    nice script, but you forgot the raw table
    also, i think it would be a good idea to reset the counters and delete any existing empty chains
    so

    iptables -F
    iptables -X
    iptables -Z
    iptables -t mangle -F
    iptables -t mangle -X
    iptables -t mangle -Z
    iptables -t nat -F
    iptables -t nat -X
    iptables -t nat -Z
    iptables -t raw -F
    iptables -t raw -X
    iptables -t raw -Z

    cheers

  • kuda April 17, 2009, 9:25 am

    ….
    ### no need to edit below ###
    IPT=/sbin/iptables
    IPT6=/sbin/ip6tables

    if [ $x = 1 ];
    then
    …..

    otherwise bash will complain – unexpected character ….

    have a nice day!

  • name October 31, 2009, 1:43 pm

    That’s what iptables-apply is for.

  • Eric January 19, 2010, 4:57 am

    I would just use the “save” command to make a copy of the iptable script. Then “restore” it via a cron command to the original script. This way you don’t create an undefended system when you restore.

  • Mihai RATZ April 20, 2010, 12:46 pm

    Alternative to cron is port knocking.

  • PeGa! May 17, 2010, 5:18 pm

    My approach to this kind of situations (after having been through a few ones) is to add a –failsafe parameter to my firewall scripts, which would run the (new) effective firewall rules with a ‘sleep 20’ after applying this new rules thus after 20 seconds, if I didn’t break the countdown, the new firewall rules are wiped out.

  • parbat June 8, 2010, 4:24 am

    wow great.. script..

    thanks..

  • Dan Gauthier September 25, 2011, 6:13 pm

    Instead of messing with cron, there is an EASY way to rerun recurring events — “watch”.

    watch is intended for things like ‘watch ls -l’, but it also works great for things like:

    ‘watch -n 30 killall -USR1 dd’
    or
    ‘watch -n300 /etc/rc.d/rc.firewall.orig’ :)

  • Dan Gauthier September 25, 2011, 6:17 pm

    Additional: If you’re worried about knocking off your watch window, try SCREEN.

    It avoids all those nasty: ‘>/dev/null 2>&1 </dev/null &' stuff and gives you multiple screens at the same time that can't be knocked off. There's a simple reconnect command: 'screen -r'.

  • David S. October 7, 2015, 4:22 pm

    I had another attempt a long time ago, using bash trap and a sleep. The script took a backup of the currently running config, did a iptables-restore on the new config. If I then didn’t hit CTRL-C within 1 minute, it would reload the backup iptables rules and my connection would be restored.

Security: Are you a robot or human?

Leave a Comment

You can use these HTML tags and attributes: <strong> <em> <pre> <code> <a href="" title="">


   Tagged with: , , , , , , ,