Take the 2-minute tour ×

I need to provision servers via SSH, and in the process, configure iptables. More precisely, I want to run the following commands in this order:

iptables -F
iptables -P INPUT DROP
iptables -A INPUT -i lo -p all -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 25 -j REDIRECT --to-port 5000
iptables -A INPUT -j DROP

How do I accomplish that without getting locked out? Can I apply those in batch?

share|improve this question
I tend to put an explicit ACCEPT at the top of chain(s) for my management traffic until I'm sure I've got everything configured as I want it. "Locking the keys in the car" is embarrassing. –  Evan Anderson Feb 10 '13 at 17:08

3 Answers 3

up vote 2 down vote accepted

I assume the reason you think you'll be locked out is that you put in the default DROP rule before configuring the ACCEPT rules.

Run the commands through a single shell command like:

bash -c 'iptables -F; iptables -P INPUT DROP; ...'

The entire string will be sent and read before being processed and then the rules will be applied. Since the commands don't require input, they'll all process, and when you're done you'll still have access.

share|improve this answer
Since I'm deploying with fabric, your solution was great since it only required a simple list join in python. –  Erik Aigner Feb 10 '13 at 17:26
Whenever I'm doing risky things that cause connection drop-outs (eg reconfiguring OpenVPN settings), I set a cronjob that will reset to defaults after a period of time. If things go well I cancel the job, if they don't I wait until it sets up access again. –  deed02392 Feb 21 at 11:27

I usually do this:

1) I backup the old iptables configuration file:

cp /etc/sysconfig/iptables /etc/sysconfig/iptables.bak

2) Before trying the new settings I execute this command to make sure I can connect back if something in the new settings locks me out (basically I replace the old rules after 10/15 minutes):

echo "mv /etc/sysconfig/iptables.bak /etc/sysconfig/iptables && service iptables restart" | at now + 15min

3) Now I can safely modify iptables rules. If something goes bad I can connect back in 15 minutes.

share|improve this answer

If you want to avoid the situation that you are locked out for a moment (and avoid the risk that the firewall setup fails due to errors) a technical alternative is to avoid the table flush for INPUT. Replace iptables -F or iptables -F INPUT by

iptables -I INPUT 1 -p tcp -m tcp --dport 22 -j ACCEPT
while iptables -D 2 INPUT; do
for chain in $(iptables -L -n | awk '/^Chain/ && $2 != "INPUT" { print $2 }'); do
  iptables -F "$chain"

Then define the rules as usual (just -A for INPUT though, no -I INPUT 1, please) and in the end remove the connection safety rule: iptables -D INPUT 1

share|improve this answer

Your Answer


