Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have CentOS 6.4 with iptables running. I manually configure iptables with Webmin with the rules:

[root@fst ~]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0 state RELATED,ESTABLISHED
3    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8 state NEW,RELATED,ESTABLISHED
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp multiport dports 22,80,8080,443,25,143,587,993,465
5    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp multiport dports 25565,35565,8123
6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp multiport dports 10000,7070
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306
8    DROP       all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Table: mangle
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

After awhile of running fine it gets switched over to the following automatically which ends up locking out my users (on Minecraft):

[root@fst ~]# service iptables status
Table: filter
Chain INPUT (policy DROP)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  66.90.68.15          0.0.0.0/0           tcp dpt:53
2    ACCEPT     udp  --  66.90.68.15          0.0.0.0/0           udp dpt:53
3    ACCEPT     tcp  --  66.90.68.15          0.0.0.0/0           tcp spt:53
4    ACCEPT     udp  --  66.90.68.15          0.0.0.0/0           udp spt:53
5    LOCALINPUT  all  --  0.0.0.0/0            0.0.0.0/0
6    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
7    INVALID    tcp  --  0.0.0.0/0            0.0.0.0/0
8    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
10   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:80
11   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:9091
12   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:10000
13   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:51413
14   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:51413
15   ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8 limit: avg 1/sec burst 5
16   ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0 limit: avg 1/sec burst 5
17   ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 11
18   ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 3
19   LOGDROPIN  all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP)
num  target     prot opt source               destination

Chain OUTPUT (policy DROP)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  0.0.0.0/0            66.90.68.15         tcp dpt:53
2    ACCEPT     udp  --  0.0.0.0/0            66.90.68.15         udp dpt:53
3    ACCEPT     tcp  --  0.0.0.0/0            66.90.68.15         tcp spt:53
4    ACCEPT     udp  --  0.0.0.0/0            66.90.68.15         udp spt:53
5    LOCALOUTPUT  all  --  0.0.0.0/0            0.0.0.0/0
6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:53
7    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53
8    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:53
9    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:53
10   ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
11   INVALID    tcp  --  0.0.0.0/0            0.0.0.0/0
12   ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
13   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpts:1:65535
14   ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           state NEW udp dpts:1:65535
15   ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0
16   ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8
17   ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 11
18   ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 3
19   LOGDROPOUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain ALLOWIN (1 references)
num  target     prot opt source               destination
1    ACCEPT     all  --  69.205.204.222       0.0.0.0/0

Chain ALLOWOUT (1 references)
num  target     prot opt source               destination
1    ACCEPT     all  --  0.0.0.0/0            69.205.204.222

Chain DENYIN (1 references)
num  target     prot opt source               destination
1    DROP       all  --  66.249.73.91         0.0.0.0/0
2    DROP       all  --  60.250.173.194       0.0.0.0/0
3    DROP       all  --  76.121.129.194       0.0.0.0/0
4    DROP       all  --  82.11.88.90          0.0.0.0/0
5    DROP       all  --  62.76.185.208        0.0.0.0/0
6    DROP       all  --  54.248.83.213        0.0.0.0/0
7    DROP       all  --  24.27.29.209         0.0.0.0/0
8    DROP       all  --  190.234.137.236      0.0.0.0/0
9    DROP       all  --  71.38.139.244        0.0.0.0/0
10   DROP       all  --  192.241.198.55       0.0.0.0/0
11   DROP       all  --  190.39.148.59        0.0.0.0/0
12   DROP       all  --  75.70.219.54         0.0.0.0/0
13   DROP       all  --  80.195.186.237       0.0.0.0/0
14   DROP       all  --  124.190.137.1        0.0.0.0/0
15   DROP       all  --  192.241.196.31       0.0.0.0/0

Chain DENYOUT (1 references)
num  target     prot opt source               destination
1    DROP       all  --  0.0.0.0/0            66.249.73.91
2    DROP       all  --  0.0.0.0/0            60.250.173.194
3    DROP       all  --  0.0.0.0/0            76.121.129.194
4    DROP       all  --  0.0.0.0/0            82.11.88.90
5    DROP       all  --  0.0.0.0/0            62.76.185.208
6    DROP       all  --  0.0.0.0/0            54.248.83.213
7    DROP       all  --  0.0.0.0/0            24.27.29.209
8    DROP       all  --  0.0.0.0/0            190.234.137.236
9    DROP       all  --  0.0.0.0/0            71.38.139.244

Chain INVALID (2 references)
num  target     prot opt source               destination
1    INVDROP    all  --  0.0.0.0/0            0.0.0.0/0           state INVALID
2    INVDROP    tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x00
3    INVDROP    tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x3F/0x3F
4    INVDROP    tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x03/0x03
5    INVDROP    tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x06
6    INVDROP    tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x05/0x05
7    INVDROP    tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x11/0x01
8    INVDROP    tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x18/0x08
9    INVDROP    tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x30/0x20
10   INVDROP    tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:!0x17/0x02 state NEW

Chain INVDROP (10 references)
num  target     prot opt source               destination
1    DROP       all  --  0.0.0.0/0            0.0.0.0/0

Chain LOCALINPUT (1 references)
num  target     prot opt source               destination
1    ALLOWIN    all  --  0.0.0.0/0            0.0.0.0/0
2    DENYIN     all  --  0.0.0.0/0            0.0.0.0/0

Chain LOCALOUTPUT (1 references)
num  target     prot opt source               destination
1    ALLOWOUT   all  --  0.0.0.0/0            0.0.0.0/0
2    DENYOUT    all  --  0.0.0.0/0            0.0.0.0/0

Chain LOGDROPIN (1 references)
num  target     prot opt source               destination
1    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:67
2    DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:67
3    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:68
4    DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:68
5    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:111
6    DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:111
7    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:113
8    DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:113
9    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpts:135:139
10   DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpts:135:139
11   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:445
12   DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:445
13   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:500
14   DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:500
15   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:513
16   DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:513
17   DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:520
18   DROP       udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:520
19   LOG        tcp  --  0.0.0.0/0            0.0.0.0/0           limit: avg 30/min burst 5 LOG flags 0 level 4 prefix `Firewall: *TCP_IN Blocked* '
20   LOG        udp  --  0.0.0.0/0            0.0.0.0/0           limit: avg 30/min burst 5 LOG flags 0 level 4 prefix `Firewall: *UDP_IN Blocked* '
21   LOG        icmp --  0.0.0.0/0            0.0.0.0/0           limit: avg 30/min burst 5 LOG flags 0 level 4 prefix `Firewall: *ICMP_IN Blocked* '
22   DROP       all  --  0.0.0.0/0            0.0.0.0/0

Chain LOGDROPOUT (1 references)
num  target     prot opt source               destination
1    LOG        tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 limit: avg 30/min burst 5 LOG flags 8 level 4 prefix `Firewall: *TCP_OUT Blocked* '
2    LOG        udp  --  0.0.0.0/0            0.0.0.0/0           limit: avg 30/min burst 5 LOG flags 8 level 4 prefix `Firewall: *UDP_OUT Blocked* '
3    LOG        icmp --  0.0.0.0/0            0.0.0.0/0           limit: avg 30/min burst 5 LOG flags 8 level 4 prefix `Firewall: *ICMP_OUT Blocked* '
4    DROP       all  --  0.0.0.0/0            0.0.0.0/0

Table: mangle
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Why do the rules keep getting updated automatically? I've tried disabling system-config-firewall in /etc/sysconfig/system-config-firewall and that didn't work, so I uninstalled it via YUM. The rules are still getting added automatically. I have no idea why; I don't want this to keep happening. Thanks for any help in advance. I've been trying to figure this out for a few days now.

share|improve this question
    
Is there any regularity to when it happens? If it's every hour at the same time, that'd point to cron; if it was a certain time after a reboot, that'd point to an at job submitted at boot time. Other patterns might point to other tools. –  MadHatter Jul 17 '13 at 8:07

1 Answer 1

I have CENTOS 6.4 too. Try checking out your iptables rule configuration file @ /etc/sysconfig/iptables. I'm pretty sure they are kept there and get read out of there even when you flush your rules after restarting the service.

share|improve this answer
    
I used pastebin since it wouldn't fit. Everything in iptables and iptables.save are identical and equal to what I want (not what it gets set to). I also included iptables-config. pastebin.com/JgWsrr2K –  Timothy Zorn Jul 17 '13 at 8:01
    
Ugh, I feel like a moron. After a few days of trying to get this sorted, I looked through the services I have set to start on boot. I have a service in there called ConfigServer Firewall (csf). I think my hosting provider had that installed on there by default. I uninstalled it and everything seems to be OK, now. Thanks for the info, Alexander Poteriachin. I think this issue is now resolved. I am currently unable to answer it myself as I have less than 10 reputation. –  Timothy Zorn Jul 17 '13 at 8:11
    
Great! Take care –  Alex Jul 17 '13 at 8:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.