Re: Default Policy = DROP. Help-me

[Ansgar -59cobalt- Wiechers <lists@planetcobalt.net>]

On 2007-10-24 Paolo wrote:
> On Wed, Oct 24, 2007 at 03:57:08PM -0200, Yuri Rodrigues wrote:
>> $iptables -t mangle -P OUTPUT ACCEPT
>> $iptables -t mangle -P INPUT ACCEPT
>> $iptables -t mangle -P POSTROUTING ACCEPT
>> echo "Policing .......................................... [ OK ]"
> ...
>> modprobe iptable_mangle
>> modprobe iptable_nat
>> echo "0" > /proc/sys/net/ipv4/ip_forward
>> echo "Loading Modules ................................... [ OK ]"
> 
> that's the wrong way of saying 'OK'; you want to say 'OK' if all went
> really ok, else say 'NOK!' and perhaps bailout, ie something like:
> 
> ...
> $iptables -t mangle -P OUTPUT ACCEPT &&\
> $iptables -t mangle -P INPUT ACCEPT &&\
> $iptables -t mangle -P POSTROUTING ACCEPT &&\
> echo "Policing .......................................... [ OK ]" || {
>   echo "Something broke in 'Policing'!"
>   exit 1
> }

You don't want to do that, because the term in curled braces is executed
when *any* of the previous commands fails (including the echo). Better
use something like this:

----8<----
fail {
  [ -n "$1" ] && echo "Error: $1." 1>&2
  exit 1
}

...
$iptables -t mangle -P OUTPUT ACCEPT      || fail "setting OUTPUT policy"
$iptables -t mangle -P INPUT ACCEPT       || fail "setting INPUT policy"
$iptables -t mangle -P POSTROUTING ACCEPT || fail "setting POSTROUTING policy"
echo "Policing .......................................... [ OK ]"
---->8----

Regards
Ansgar Wiechers
-- 
"The Mac OS X kernel should never panic because, when it does, it
seriously inconveniences the user."
--http://developer.apple.com/technotes/tn2004/tn2118.html