IPFW disconnections and resets

[Neo-Vortex]

On Fri, 29 Apr 2005, Siddhartha Jain wrote:

> I am facing two problems:
> - SSH sessions timeout after a while

In PuTTY or whatever other SSH client you use - enable sending of
keepalive packets (for PuTTY - under connection settings) (not sure if
this is cause of ipfw or what, but the tcp session is timing out)

> - When I run "/sbin/ipfw -q -f flush" in the rules script all connection
> get reset (and I am thrown out of the box).

Yep, standard functionality, easy fix though:

-- Start file /root/bin/fws --
#!/bin/sh
fw > /root/fws-out 2>&1 &
-- End File --

-- Start file /root/bin/fw --
#!/bin/sh

ipfw="ipfw"


# Flush Old Rules
$ipfw -f flush

# Tempoary rules to stop connections being killed when reloading rules
$ipfw add 1 allow tcp from any to any established
$ipfw add 2 allow udp from any to any

<snip> - your rules go here (dont use rule 1 or 2 though)

# Clean up tempoary rules used to stop connections being killed
$ipfw delete 1
$ipfw delete 2
-- End File --

I use that all the time, mabe 1 out of 100 times it will kill a ssh
session (only one that has irssi open cause of the time updating it kills
it, i have it set to update every second though, so normally it'd be like
1 out of 500 or so) and even if it does, it still finishes loading the
ruleset anyway so you can just ssh straight back in

If you havn't guessed, you run /root/bin/fws - you can change it to
whatever you want of course, also, the output is redirected to
/root/fws-out - if you dont redirect it, it'll kill your ssh session -
although it won't stop it loading the other rules

~Neo-Vortex