Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an iptable rule where I allow a subnet of IPs. The rule is as the following:

iptables -I INPUT 2 -i eth0 -s x.x.x.x/24 -d x.x.X.x -j ACCEPT

For example, I want to allow subnet 172.16.0.0/24. May I face up with a problem like an IP from this subnet has no access, although I have configured this subnet to be allowed?

I am dealing with an issue like this. I have configured 172.16.0.0/24 to allowed from iptables but when I try to access from IP 172.16.0.9, I have no access.

share|improve this question
1  
Can you update your question with the output for iptables-save ? –  krisFR Dec 31 '13 at 11:37
    
After I ran iptables-save, I ran iptables -n -v -L --line-numbers and from the output, there is a line with the allowed subnet I added. However, I have a few matches. –  user200913 Dec 31 '13 at 12:25
    
I've asked for the output of iptables-save because maybe you have another rule that overrides the one you talk about in your question...Are you able to access from another ip than 172.16.0.9 but in same subnet 172.16.0.0/24 ? –  krisFR Dec 31 '13 at 12:31
    
I think of another rule that may overwrite that rule I have recently added. But, nothing like that happens. I can access from some IPs but not from all IPs of the subent. –  user200913 Dec 31 '13 at 12:42
1  
Can you update your question with the output for iptables-save ? –  coincoin Dec 31 '13 at 13:30

3 Answers 3

You can debug netfilter rules by enabling the TRACE target:

First load the relevant kernel module to log directly to syslog:

modprobe -i ipt_LOG

And then create a rule to log all traffic from your misbehaving system:

iptables -t raw -A PREROUTING --source 172.16.0.9 -p tcp -j TRACE

The packets are logged with the string prefix: TRACE: tablename:chain- name:type:rulenum where type can be "rule" for plain rule, "return' for implicit rule at the end of a user defined chain and "policy" for the policy of the built in chains. The rulenum can be found with iptables -L --line-numbers

share|improve this answer

Try to remove "-d x.x.x.x". I say this because INPUT means all traffic destined to your machine, so no need to specify destination. EDIT: Also, try to add "-p tcp" before "-s x.x.x.x/24". I think you need to specify the protocol for the match. – aseaudi 17 mins ago

share|improve this answer
    
I tried this. The problem remians. –  user200913 Dec 31 '13 at 13:09
    
Ok, now try to add "-p tcp" before "-s x.x.x.x/24". I think you need to specify the protocol for the match. –  aseaudi Dec 31 '13 at 13:24

I am thinking about two possible issues:

1 - you are not allowing the traffic to go out from your machine

iptables -I OUTPUT 1 -i eth0 -d x.x.x.x/24 -j ACCEPT

2 - you are preventing broadcast packets from getting to your machine

try this instead of your original input:

iptables -I INPUT 1 -i eth0 -s x.x.x.x/24 -j ACCEPT

without using a destination ip.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.