0

Can someone please take a look at this iptables data and tell me what's wrong with it?

The paste 24h has been a nightmare, I couldn't even SSH to my server, and the only way I could manage to get the server back online was to use an KVM console and disable the firewall (ie. service iptables stop)

The worst thing is: I have to re-run this command service iptables stop every like 15-30 minutes to get the server back online, this is crazy!

# Generated by iptables-save v1.3.5 on Sun Dec  8 21:56:04 2013
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:ALLOWIN - [0:0]
:ALLOWOUT - [0:0]
:INVALID - [0:0]
:INVDROP - [0:0]
:LOCALINPUT - [0:0]
:LOCALOUTPUT - [0:0]
:LOGDROPIN - [0:0]
:LOGDROPOUT - [0:0]
:acctboth - [0:0]
-A INPUT -j acctboth 
-A INPUT -i eth0 -j LOCALINPUT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -i eth0 -p tcp -j INVALID 
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2077 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2078 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2082 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2083 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2086 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2087 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2095 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2096 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2382 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 26 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 30000:35000 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 12001:12009 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 9418 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8001 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8002 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6379 -j ACCEPT 
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 119 -j ACCEPT 
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 20 -j ACCEPT 
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 21 -j ACCEPT 
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT 
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 2382 -j ACCEPT 
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 26 -j ACCEPT 
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 119 -j ACCEPT 
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT 
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 0 -m limit --limit 1/sec -j ACCEPT 
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 11 -j ACCEPT 
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 3 -j ACCEPT 
-A INPUT -i eth0 -j LOGDROPIN 
-A OUTPUT -j acctboth 
-A OUTPUT -o eth0 -j LOCALOUTPUT 
-A OUTPUT -o eth0 -p tcp -m tcp --dport 53 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m tcp --sport 53 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m udp --sport 53 -j ACCEPT 
-A OUTPUT -o lo -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -j INVALID 
-A OUTPUT -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 9418 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 37 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 43 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 113 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 873 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 2087 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 2089 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 2703 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 2382 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 26 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 30000:35000 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 12001 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 12009 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 6379 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 119 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 20 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 21 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 113 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 123 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 873 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 6277 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 2382 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 26 -j ACCEPT 
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 119 -j ACCEPT 
-A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 0 -m limit --limit 1/sec -j ACCEPT 
-A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT 
-A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 11 -j ACCEPT 
-A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 3 -j ACCEPT 
-A OUTPUT -o eth0 -j LOGDROPOUT 
-A ALLOWIN -s 41.228.96.0/255.255.255.0 -i eth0 -j ACCEPT 
-A ALLOWIN -s 41.228.96.65 -i eth0 -j ACCEPT 
-A ALLOWIN -s 209.51.153.82 -i eth0 -j ACCEPT 
-A ALLOWOUT -d 41.228.96.0/255.255.255.0 -o eth0 -j ACCEPT 
-A ALLOWOUT -d 41.228.96.65 -o eth0 -j ACCEPT 
-A ALLOWOUT -d 209.51.153.82 -o eth0 -j ACCEPT 
-A INVALID -m state --state INVALID -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags FIN,ACK FIN -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags PSH,ACK PSH -j INVDROP 
-A INVALID -p tcp -m tcp --tcp-flags ACK,URG URG -j INVDROP 
-A INVALID -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j INVDROP 
-A INVDROP -j DROP 
-A LOCALINPUT -i eth0 -j ALLOWIN 
-A LOCALOUTPUT -o eth0 -j ALLOWOUT 
-A LOGDROPIN -p tcp -m tcp --dport 67 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 67 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 68 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 68 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 111 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 111 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 113 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 113 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 135:139 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 135:139 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 445 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 445 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 513 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 513 -j DROP 
-A LOGDROPIN -p tcp -m tcp --dport 520 -j DROP 
-A LOGDROPIN -p udp -m udp --dport 520 -j DROP 
-A LOGDROPIN -p tcp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *TCP_IN Blocked* " 
-A LOGDROPIN -p udp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *UDP_IN Blocked* " 
-A LOGDROPIN -p icmp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *ICMP_IN Blocked* " 
-A LOGDROPIN -j DROP 
-A LOGDROPOUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 30/min -j LOG --log-prefix "Firewall: *TCP_OUT Blocked* " --log-uid 
-A LOGDROPOUT -p udp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *UDP_OUT Blocked* " --log-uid 
-A LOGDROPOUT -p icmp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *ICMP_OUT Blocked* " --log-uid 
-A LOGDROPOUT -j DROP 
-A acctboth -s 111.11.11.146 -i ! lo -p tcp -m tcp --dport 80 
-A acctboth -d 111.11.11.146 -i ! lo -p tcp -m tcp --sport 80 
-A acctboth -s 111.11.11.146 -i ! lo -p tcp -m tcp --dport 25 
-A acctboth -d 111.11.11.146 -i ! lo -p tcp -m tcp --sport 25 
-A acctboth -s 111.11.11.146 -i ! lo -p tcp -m tcp --dport 110 
-A acctboth -d 111.11.11.146 -i ! lo -p tcp -m tcp --sport 110 
-A acctboth -s 111.11.11.146 -i ! lo -p icmp 
-A acctboth -d 111.11.11.146 -i ! lo -p icmp 
-A acctboth -s 111.11.11.146 -i ! lo -p tcp 
-A acctboth -d 111.11.11.146 -i ! lo -p tcp 
-A acctboth -s 111.11.11.146 -i ! lo -p udp 
-A acctboth -d 111.11.11.146 -i ! lo -p udp 
-A acctboth -s 111.11.11.146 -i ! lo 
-A acctboth -d 111.11.11.146 -i ! lo 
-A acctboth -s 111.11.11.160 -i ! lo -p tcp -m tcp --dport 80 
-A acctboth -d 111.11.11.160 -i ! lo -p tcp -m tcp --sport 80 
-A acctboth -s 111.11.11.160 -i ! lo -p tcp -m tcp --dport 443 
-A acctboth -d 111.11.11.160 -i ! lo -p tcp -m tcp --sport 443 
-A acctboth -s 111.11.11.160 -i ! lo -p tcp -m tcp --dport 25 
-A acctboth -d 111.11.11.160 -i ! lo -p tcp -m tcp --sport 25 
-A acctboth -s 111.11.11.160 -i ! lo -p tcp -m tcp --dport 110 
-A acctboth -d 111.11.11.160 -i ! lo -p tcp -m tcp --sport 110 
-A acctboth -s 111.11.11.160 -i ! lo -p icmp 
-A acctboth -d 111.11.11.160 -i ! lo -p icmp 
-A acctboth -s 111.11.11.160 -i ! lo -p tcp 
-A acctboth -d 111.11.11.160 -i ! lo -p tcp 
-A acctboth -s 111.11.11.160 -i ! lo -p udp 
-A acctboth -d 111.11.11.160 -i ! lo -p udp 
-A acctboth -s 111.11.11.160 -i ! lo 
-A acctboth -d 111.11.11.160 -i ! lo 
-A acctboth -i ! lo 
COMMIT
# Completed on Sun Dec  8 21:56:04 2013
# Generated by iptables-save v1.3.5 on Sun Dec  8 21:56:04 2013
*nat
:PREROUTING ACCEPT [52:2991]
:POSTROUTING ACCEPT [131:10103]
:OUTPUT ACCEPT [131:10103]
COMMIT
# Completed on Sun Dec  8 21:56:04 2013
# Generated by iptables-save v1.3.5 on Sun Dec  8 21:56:04 2013
*mangle
:PREROUTING ACCEPT [1314:156437]
:INPUT ACCEPT [1314:156437]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1741:1844557]
:POSTROUTING ACCEPT [1741:1844557]
COMMIT
# Completed on Sun Dec  8 21:56:04 2013

The KVM console showed a lot of errors like this

Clearly the errors are caused by these lines:

-A LOGDROPIN -p tcp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *TCP_IN Blocked* " 
-A LOGDROPIN -p udp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *UDP_IN Blocked* " 
-A LOGDROPIN -p icmp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *ICMP_IN Blocked* " 
-A LOGDROPIN -j DROP 
-A LOGDROPOUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 30/min -j LOG --log-prefix "Firewall: *TCP_OUT Blocked* " --log-uid 
-A LOGDROPOUT -p udp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *UDP_OUT Blocked* " --log-uid 
-A LOGDROPOUT -p icmp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *ICMP_OUT Blocked* " --log-uid 
-A LOGDROPOUT -j DROP 

But I have absolutely no idea why this is happening and how to fix this!!!

PS. As you can tell, I'm a total newbie at this firewall rules thing.

I'm running CentOS 6.4 + Apache 2.2.15, I'm not using cPanel anymore on this server.

5
  • What did cPanel support tell you? Jul 26, 2014 at 3:25
  • @MichaelHampton I disabled cPanel like a year ago (though I didn't do any cleanup). I edited my question to add that info
    – TheDude
    Jul 26, 2014 at 3:27
  • 1
    That's not really good enough. cPanel makes so many nonstandard changes to a server that the only reasonable way to get rid of it is to reinstall the server from scratch. Jul 26, 2014 at 3:28
  • @MichaelHampton I truly wish I could, this server still does use some legacy software (can't upgrade right now, so I have to make sure the show continue running until I figure out some magic solution)
    – TheDude
    Jul 26, 2014 at 3:31
  • The firewall rules appears to be ok, something may be updating your firewall rules though. Could you list updated rules of when you have this issue?
    – denisvm
    Jul 26, 2014 at 4:14

2 Answers 2

1

I see 2 things :

  1. You should not put any rules before:

    -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

  2. Your "INVALID" rule should not be there, and looks far too much convoluted, and likely to be buggy.

I suggest you limit it to only -m state --state INVALID and I strongly suggest that you log the INVALID packets.

There are also bugs in which netfilter will treat valid packets as invalid ( of course netfilter says that it is other vendors who are wrong ), especially when you are behind a load balancer / firewall, but at first you should simply remove the pseudo "invalid check", and if you believe they have any value you should put them after the --state RELATED,ESTABLISHED rule and log the packets you think are invalid.

The messages on the KVM console are perfectly normal according to your set of rules.

0

I suggest eliminating the --limit records and see if it works. If you have problems with denial-of-service attacks then you can try to figure out limits. But my guess is you don't need them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .