Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm about to change iptables configuration and interface speed and duplex settings over SSH. What are the possibilities to rollback the changes in case of host becomes unreachable? I guess simple:

ip addr add dev eth0; ping -c1 || ip addr add dev eth0

..is bit risky because if SSH connection drops immediately after the IP address change, then shell should be also killed and ping -c1 || ip addr add dev eth0 part is never executed? Should one use crontab in case of dangerous changes on a remote host? Any other clever method?

share|improve this question
up vote 10 down vote accepted

In a screen or tmux session, set up a shell that will reverse your changes after a delay. I don't know anything about iptables, so can't help with that, but something like this has saved my proverbial bacon on numerous occasions while altering live firewall configs on FreeBSD:

# In one `screen` or `tmux` window
% sleep 60 && <command to reverse changes>

In another window, you can now make your changes, and if they work you can kill the sleep. Note that because we're using &&, the command to back out your changes won't be run when you kill sleep.

If your changes don't work, wait a few seconds and your back out command will run.

share|improve this answer
Thanks! Your solution is in my opinion more convenient than the crontab one. – Martin Aug 12 '14 at 11:36
actually it is always a good idea to use screen or tmux when working through ssh, because if for some reason the connection drops your running applications won't get a SIGPIPE and die, and you can always reattach later – pqnet Aug 12 '14 at 13:04
@pqnet Absolutely. I have been encouraging my colleagues to do just this, and we have a lot fewer "my long running job died" complaints. We do have a lot of forgotten screen sessions on most of our servers, though... – D_Bye Aug 12 '14 at 13:13
Instead, after running the command, you can just Ctrl+z, disown -h, bg. If the connection dies, the command will still be running. – Sparhawk Aug 12 '14 at 17:29
@Sparhawk No, if you do that the command will block or crash trying to print to the dead terminal. (Nitpickers: yes, yes, it might work, in the same way that falling from the fifth floor isn't guaranteed to kill you.) – Gilles Aug 12 '14 at 21:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.