I have created an iptables config which I thought that I understood, however it seems to be preventing munin from generating graphs and I'm not sure why. If I disable iptables, munin will generate graphs as expected. I have included my iptables config and munin config. Does anyone see how munin is being blocked? Munin should only be connecting and listening on the loopback device.
*filter # Drop everything by default :INPUT DROP [0:0] # We are not routing packets :FORWARD DROP [0:0] # Don't filter output :OUTPUT ACCEPT [0:0] # Add the fail2ban chain :fail2ban-SSH - [0:0] # Drop NULL packets -A INPUT -p tcp --tcp-flags ALL NONE -j DROP # Reject a syn-flood attack -A INPUT -p tcp ! --syn -m state --state NEW -j DROP # Drop XMAS packets -A INPUT -p tcp --tcp-flags ALL ALL -j DROP # We want the response packets... -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Accept all from loopback -A INPUT -i lo -j ACCEPT # Send packets for port 22 to fail2ban, it may drop them -A INPUT -p tcp -m tcp --dport 22 -j fail2ban-SSH -A fail2ban-SSH -j RETURN # If fail2ban didn't drop it let it on through -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT # HTTP(S) -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
Relevant porition of munin config:
# A list of addresses that are allowed to connect. This must be a # regular expression, since Net::Server does not understand CIDR-style # network notation unless the perl module Net::CIDR is installed. You # may repeat the allow line as many times as you'd like allow ^127\.0\.0\.1$ allow ^::1$ # Which address to bind to; host * # host 127.0.0.1 # And which port port 4949