Skip to content
Register

I typo'd a firewall rule and blocked the entire country

General Discussion by sarahjey 2 replies 120 views
sarahjey

Member OP

4 #1

Has anyone here ever made a really bad firewall typo! I was trying to block one IP for my project and I think I used the wrong mask or something? Suddenly nothing worked and I had to reboot from the provider panel... felt so stupid... Thanks everyone for any stories to make me feel less dumb...

learning on $5 VPS and prayers
FlowSana

Member

SRE

3 #2

Common issue. Specific recommendations:

  • Always test rules with a temporary timeout (iptables --timeout 300)
  • Use configuration management (Ansible 2.15+, Puppet 7) with syntax validation
  • Maintain out-of-band access: IPMI, serial console, or provider VNC

I once misconfigured a Cisco ASA 5516-X ACL and blackholed a /24 for 12 minutes during a change window. Version 9.14(2)8, if you are tracking. Practical recommendation: implement a dead man's timer that reverts changes automatically.

It's always DNS. Always.
RE

Member

#3

Peering

Cfg typo /8 instead of /32
BGP still up tho
V4 table: oops
V6: not affected, tier-1 move

Rt to coffee shop, laptop, usb tether
Fw from outside, fixed in 20min

Transit provider that day

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft