Re: [sanewall-dev] Changing activation policy

On Mon, May 21, 2012 at 09:19:04AM +0200, Thomas Arendsen Hein wrote:
> * Phil Whineray <[email protected]> [20120519 18:53]:
> > Could people please let me know if this will adversely affect them and
> > if possible test what effect it has?

> I am using DROP on INPUT/OUTPUT/FORWARD since 2003 on multiple
> (40-60?) hosts and absolutely never had a disconnect of the ssh
> session I used to activate the rules, even with very large rulesets,
> where it took up to 5 minutes to activate >5000 rules across many
> interfaces.

> See my very old bug report about this:
> http://sourceforge.net/tracker/?func=detail&atid=487695&aid=756001&group_id=58425

Good to know (and where the policy setting variables originate :)

> Therefore I suggest setting it to DROP for all three activation
> policies.

I may do that, and bring the options front and centre in the
documentation so people can make an informed choice if they want to
revert to the old behaviour.

I think ACCEPT during the initial phase is generally not too bad when
the connection will be severed upon completion, per Costas description.
I am convinced it is not safe when an "all" service is in use and DROP
would eliminate the problem.

If I make DROP the default I will see if there is some way to protect
existing connections (maybe allow prior-established traffic immediately
and delete those rule(s) at the end?). New connections can wait until
the appropriate rules are loaded.

Thanks for the feeback

Phil

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/