Articles | johnlewis.ie | Page 3

By: John Lewis  05/12/2011

Today’s post is definitely of the short and sweet variety. I happened across the file list for iptables the other day and noticed a binary I had not come across before “iptables-apply”. Iptables-apply is a script that applies firewall rules and then waits a configurable amount of time, for user input, to confirm the changes were successful. In other words if you aren’t a perfect admin (who is right!) and manage to accidentally lock yourself out by putting an iptables rule in wrong, iptables-apply will automatically revert back to the previous set of rules and you’ll get access again.

Could’ve saved me literally some diesel over the past few years that one!

From the iptables-apply man page:

iptables-apply   will  try  to  apply  a  new  ruleset  (as  output  by
iptables-save/read by iptables-restore) to iptables,  then  prompt  the
user  whether the changes are okay. If the new ruleset cut the existing
connection, the user will not be able to answer affirmatively. In  this
case,  the  script rolls back to the previous ruleset after the timeout
expired. The timeout can be set with -t.

This has the advantage over Shorewall in that Shorewall will only keep existing connections open when new rules are applied. If you happen to lose connectivity, tough luck, Shorewall will obediently block further connections on your borked firewall.


Other products and services from John Lewis

05/12/2011

Articles | johnlewis.ie

Admittedly a bit of a long shot, I decided “what the hey” upgrading to Postfix 2.8 isn’t going to make things any worse, and it may sort the problem out. Trawling through the various mailing lists reveals that “network biopair”, whatever that is, has been removed from Postfix as of December 2010, v2.8. Assuming you’re able to successfully complete the upgrade you will still probably be left with a container which doesn’t boot properly.


05/12/2011

Articles | johnlewis.ie | Page 2

Saorview can be received through a standard wide-band UHF aerial, there will be an accompanying satellite service for people who are unable to receive the terrestrial signal but it hasn’t even launched in trial form yet and will require the purchase of more equipment in the form of a special satellite dish and receiver.


05/12/2011

Articles | johnlewis.ie | Page 4

Unfortunately I found out after much head banging and googling “magic packet” doesn’t work over wireless networks, apparently because wireless frames screw the magic packet up so that the wakee doesn’t recognise it any more. So if you want to use WOL by sending the wake up through a wireless network your options are limited and it depends on the network card you have.