I am trying to export my rules from one server to another, but for some reason they fail on one. One server is Xen and the other OpenVZ (this one is the one causing trouble). They are both running Ubuntu (though different versions, 8.04 and 10.10 respectively) and also different versions of iptables (1.3.8 and 1.4.4 respectively).
I exported my rules fine, but when I run them I'm getting an error on the COMMIT line. So I commented out each line in my rules one by one and discovered these three lines are the culprits:
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p tcp -m state --state NEW --dport 23 -j ACCEPT -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
What is wrong with these lines? They look fine to me and they run fine on my Xen server...
This is the contents of the original rules file:
*filter # Allows all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0 -A INPUT -i lo -j ACCEPT -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT # Accepts all established inbound connections -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Allows all outbound traffic # You can modify this to only allow certain traffic -A OUTPUT -j ACCEPT # Allows HTTP and HTTPS connections from anywhere (the normal ports for websites) -A INPUT -p tcp --dport 80 -j ACCEPT -A INPUT -p tcp --dport 443 -j ACCEPT # Allows Tomcat, sms, and newrelic -A INPUT -p tcp --dport 8080 -j ACCEPT #-A INPUT -p tcp --dport 8009 -j ACCEPT # Allows SSH connections # # THE -dport NUMBER IS THE SAME ONE YOU SET UP IN THE SSHD_CONFIG FILE # -A INPUT -p tcp -m state --state NEW --dport 23 -j ACCEPT # Allow ping -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT # log iptables denied calls -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 # Reject all other inbound - default deny unless explicitly allowed policy -A INPUT -j REJECT -A FORWARD -j REJECT COMMIT
Ok, so it looks like the only thing in common between all three of these is the option "-m", none of the rules which work have that option... what gives?