On 05/24/2012 02:24 AM, Artur Uszyński wrote:
> Hello.
>
> In a situation like this:
> - a firewall has two or more internet connections,
> - a firewall runs shorewall 4.5.1 (multiple isps configured)
> - one connection is broken,
> - default route in the main routing table leads through the failed connection,
> - a firewall is 20000 km away from admin ;),
>
> and after taking the following actions:
> - logging in to the firewall through working connection,
> - changing shorewall configuration and making a stupid error in it
> - doing "shorewall stop; shorewall start" :s,
>
> you must take nearest flight from Europe to Australia to bring the firewall
> back to life ;) (because returning traffic goes through default, non-working
> link)
>
> Can shorewall handle such cases in a way, which would prevent similar
> accidents ? Did I miss any option ?
A couple of things:
a) Before making a configuration change, execute 'shorewall save'. This
will save the currently running configuration which can then be
restored if a 'restart' fails.
b) Use 'shorewall restart' rather than 'shorewall stop; shorewall
start'. 'shorewall stop' restores the default route(s) that were in
place before the last 'start' command. 'shorewall restart' replaces,
adds or deletes default routes based on the state of the links. And
if the 'restart' fails, the firewall will be restored to its prior
state.
c) After you are satisfied that the change works correctly, do another
'shorewall save'.
Note: As someone noted in another response to your post, the
'safe-restart' command combines 'save' and 'restart' in a single command.
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Shorewall-users mailing list
Shorewall-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/shorewall-users
