Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have created an iptables config which I thought that I understood, however it seems to be preventing munin from generating graphs and I'm not sure why. If I disable iptables, munin will generate graphs as expected. I have included my iptables config and munin config. Does anyone see how munin is being blocked? Munin should only be connecting and listening on the loopback device.

iptables config:

*filter

# Drop everything by default
:INPUT DROP [0:0]

# We are not routing packets
:FORWARD DROP [0:0]

# Don't filter output
:OUTPUT ACCEPT [0:0]

# Add the fail2ban chain
:fail2ban-SSH - [0:0]

# Drop NULL packets
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# Reject a syn-flood attack
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# Drop XMAS packets
-A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# We want the response packets...
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Accept all from loopback
-A INPUT -i lo -j ACCEPT

# Send packets for port 22 to fail2ban, it may drop them
-A INPUT -p tcp -m tcp --dport 22 -j fail2ban-SSH
-A fail2ban-SSH -j RETURN
# If fail2ban didn't drop it let it on through
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

# HTTP(S)
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Relevant porition of munin config:

# A list of addresses that are allowed to connect.  This must be a
# regular expression, since Net::Server does not understand CIDR-style
# network notation unless the perl module Net::CIDR is installed.  You
# may repeat the allow line as many times as you'd like

allow ^127\.0\.0\.1$
allow ^::1$

# Which address to bind to;
host *
# host 127.0.0.1

# And which port
port 4949
share|improve this question
    
Why the downvote? –  hyphen this Jan 8 at 15:43

1 Answer 1

From the man page for iptables:

every packet only passes through one of the three chains (except loopback traffic, which involves both INPUT and OUTPUT chains);

In other words, loopback traffic does get caught by iptables, as you've now discovered...

I'd suggest something like the following:

-A INPUT -p tcp -m tcp -s 127.0.0.1 -d 127.0.0.1 --dport 4949 -j ACCEPT
share|improve this answer
    
Shouldn't the ":OUTPUT ACCEPT [0:0]" and "-A INPUT -i lo -j ACCEPT" in the config file account for this though? –  hyphen this Jan 8 at 15:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.