Update Firewall Rules

[David Landgren]

Giorgos Keramidas wrote:
> Doing thing on a remote machine that you cannot possibly access if
> something goes wrong (i.e. a collcation server) is probably not a good
> idea though.  In cases like these, I usually follow the following
> procedure when tinkering with firewall rules to avoid locking myself
> out of a machine I can't login to afterwards:
> 
> 	a) Schedule a reboot in 15 minutes or so.
> 
> 	b) Load new firewall rules.
> 
> 	c) Test rules.
> 
> 	d) Unschedule the reboot if all goes well.

That's a little bit savage. I hate rebooting machines if I'm not around 
to nurse them. People leaving bootable CDs in the drive, or floppies, 
bootable or otherwise, or configs that drift so that ssh fails to start 
up, or after the last ISP switch you forgot to set the defaultrouter to 
the new one... I've had all these things happen over the years.

The ipfw man page has an excellent example that shows you have to create 
a set of rules, enable them and if you don't hit ^C in 15 seconds (or 
whatever time you need to test), it backs the set out and you retrieve 
your initial ruleset.

I have used this approach on a couple of occasions, and it's very handy. 
Check the man page.

David