Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have created an iptables config which I thought that I understood, however it seems to be preventing munin from generating graphs and I'm not sure why. If I disable iptables, munin will generate graphs as expected. I have included my iptables config and munin config. Does anyone see how munin is being blocked? Munin should only be connecting and listening on the loopback device.

iptables config:


# Drop everything by default

# We are not routing packets

# Don't filter output

# Add the fail2ban chain
:fail2ban-SSH - [0:0]

# Drop NULL packets
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# Reject a syn-flood attack
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# Drop XMAS packets
-A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# We want the response packets...

# Accept all from loopback
-A INPUT -i lo -j ACCEPT

# Send packets for port 22 to fail2ban, it may drop them
-A INPUT -p tcp -m tcp --dport 22 -j fail2ban-SSH
-A fail2ban-SSH -j RETURN
# If fail2ban didn't drop it let it on through
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Relevant porition of munin config:

# A list of addresses that are allowed to connect.  This must be a
# regular expression, since Net::Server does not understand CIDR-style
# network notation unless the perl module Net::CIDR is installed.  You
# may repeat the allow line as many times as you'd like

allow ^127\.0\.0\.1$
allow ^::1$

# Which address to bind to;
host *
# host

# And which port
port 4949
share|improve this question
Why the downvote? – hyphen this Jan 8 '14 at 15:43

From the man page for iptables:

every packet only passes through one of the three chains (except loopback traffic, which involves both INPUT and OUTPUT chains);

In other words, loopback traffic does get caught by iptables, as you've now discovered...

I'd suggest something like the following:

-A INPUT -p tcp -m tcp -s -d --dport 4949 -j ACCEPT
share|improve this answer
Shouldn't the ":OUTPUT ACCEPT [0:0]" and "-A INPUT -i lo -j ACCEPT" in the config file account for this though? – hyphen this Jan 8 '14 at 15:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.