Thanks, good to know I wasn't missing anything.
The cron job certainly works in a development environment. There is also
the approach to use a script that captures the current state, loads the
new rules, then waits for keyboard input for a length of time. If there
isn't a "yes, keep these" response, it reverts to the previous state.
It's not under GPL, but one example of this can be found in FreeBSD,
tailored for use with ipfw:
https://svnweb.freebsd.org/base/releng/11.1/share/examples/ipfw/change_rules.sh
Jeff
On 8/21/17 9:09 AM, J Doe wrote:
Hi Jeff,
As far as I know there is not a command line option for nft to parse
the syntax to check that it is correct and then NOT apply the ruleset.
I know pf (Mac OS X and OpenBSD), has this and it's quite handy.
The wiki does have documentation for how to debug the rules (testing
what rule fires on what packet, etc.), at [1] but doesn't mention
syntax checking.
If you are accidentally locking yourself out you could create a cron
job that calls "nft rule flush ruleset" to drop the firewall and
schedule it to run every few minutes or so.
- J
Sources:
[1]
https://wiki.nftables.org/wiki-nftables/index.php/Ruleset_debug/tracing
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
