up vote 3 down vote favorite
1
share [g+] share [fb]

I can run iptables-save and dump output to stdout but if I redirect to a file - the file is empty:

    [root@nhd-vlx2 tmp]# iptables-save  
    # Generated by iptables-save v1.4.7 on Sun Dec 18 15:11:42 2011
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [90971:17757587]
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
    -A INPUT -p icmp -j ACCEPT 
    -A INPUT -i lo -j ACCEPT 
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 9090:9999 -j ACCEPT 
    -A INPUT -j REJECT --reject-with icmp-host-prohibited 
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited 
    COMMIT
    # Completed on Sun Dec 18 15:11:42 2011
    [root@nhd-vlx2 tmp]# iptables-save  > save
    [root@nhd-vlx2 tmp]# cat save
    [root@nhd-vlx2 tmp]# 
    [root@nhd-vlx2 tmp]#

Piping works (iptables-save | cat), and so saving to file through tee works too, but why would iptables-save not allows saving to a file?

The only reason I can think is that this machine may be infected by a virus (an attempt to weaken a firewall)

link|improve this question
let me guess - Red Hat/CentOS? – Rilindo Dec 18 '11 at 21:06
Centos6, this used to be fine on centos5 (but as you suggest, maybe selinux s getting in the way) – nhed Dec 18 '11 at 21:43
feedback

2 Answers

up vote 3 down vote accepted

Long shot, but:

Somebody else posted a similar problem in another forum. As it turns out, the SELinux context is wrong.

Run ls -laZ on iptables-multi. It should return with:

-rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /sbin/iptables-multi

All the other iptables files are symlinked to it:

[root@cacti tmp]# ls -laZ /sbin/iptables*
lrwxrwxrwx. root root system_u:object_r:bin_t:s0       /sbin/iptables -> iptables-multi
-rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /sbin/iptables-multi
lrwxrwxrwx. root root system_u:object_r:bin_t:s0       /sbin/iptables-restore -> iptables-multi
lrwxrwxrwx. root root system_u:object_r:bin_t:s0       /sbin/iptables-save -> iptables-multi

If the SELinux context is not correct, change it with the chcon command on the main file:

chcon -u system_u -t iptables_exec_t /sbin/iptables-multi

If the SELinux context on the symlinks are not correct, fix them using the above command (although this time with the bin_t type)

link|improve this answer
As far as I can tell the output was the same as yours: rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /sbin/iptables-multi ... and the symlinks also look the same lrwxrwxrwx. root root system_u:object_r:bin_t:s0 /sbin/iptables-save -> iptables-multi – nhed Dec 18 '11 at 21:38
Disabling selinux wth echo 0 >/selinux/enforce makes iptables-save behave as expected ... so what is selinux trying to save me from? – nhed Dec 18 '11 at 21:46
The default behavior of selinux wouldn't cause this. You mentioned that this used to be Centos 5 - was this an upgrade or a complete rebuild? – Rilindo Dec 18 '11 at 22:39
At any event, I would probably suggest do a cat on /var/log/audit/audit.log and pipe it to audit2allow to see if it notices anything odd when you attempted to save iptables-save to file with a redirect – Rilindo Dec 18 '11 at 23:05
This a fresh install of Centos6 seen both on a VM and a machine that was formatted+installed. (2) I may have mislead a little, its quite possible that I have disabled selinux on my Centos5.5 host. (3) audit2allow shows allow iptables_t vmblock_t:file write; – nhed Dec 18 '11 at 23:58
show 3 more comments
feedback
up vote 0 down vote

As per Rilindo comment, if you are on RedHat the docs mention:

~]# /sbin/service iptables save 
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]
link|improve this answer
service iptables save is a wrapper around iptables-save. The difference is that you can use iptables-save to write to any file, while service iptables save writes to /etc/sysconfig/iptables-save and /etc/sysconfig/iptables by default. – Rilindo Dec 18 '11 at 21:32
@Rilindo - Yes, I understand but this would tell us if the iptables is totally ok (which sounds like it is as tee/cat work just redirection fails). So could the shell be globbing the command somehow? – Wayne Dec 18 '11 at 21:42
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.