0

What do the following rules mean? The rules were put in by a sysadmin and seem to be working, but I think there is some redundancy in them. My goal is to allow connections on port 11211. This is on a memcache server that is connected to from various web servers.

memcache server internal ip: 10.181.16.192

memcache server external ip: 166.78.9.65

# Generated by iptables-save v1.4.7 on Sat Sep 27 14:15:42 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [198925:147304500]
:RH-Firewall-1-INPUT - [0:0]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh 
-A INPUT -s 10.181.16.192/32 -p tcp -m tcp --dport 11211 -j ACCEPT 
-A INPUT -j RH-Firewall-1-INPUT 
-A FORWARD -j RH-Firewall-1-INPUT 
-A RH-Firewall-1-INPUT -i eth1 -p tcp -m tcp --dport 11211 -j ACCEPT 
-A RH-Firewall-1-INPUT -s 10.181.26.42/32 -p tcp -m tcp --dport 11211 -j ACCEPT 
-A RH-Firewall-1-INPUT -s 10.181.16.192/32 -p tcp -m tcp --dport 11211 -j ACCEPT 
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 22 -m comment --comment "SSH" -j ACCEPT 
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 443 -m comment --comment "HTTPS" -j ACCEPT 
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 80 -m comment --comment "HTTP" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 67.222.16.43/32 -p tcp -m tcp --dport 3306 -m comment --comment "MySQL" -j ACCEPT 
-A RH-Firewall-1-INPUT -i eth1 -p tcp -m tcp --dport 3306 -m comment --comment "MySQL" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 10.181.16.33/32 -i eth1 -p tcp -m tcp --dport 11211 -m comment --comment "memcached" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 166.78.10.99/32 -i eth1 -p tcp -m tcp --dport 11211 -m comment --comment "memcached" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 174.143.23.0/25 -m comment --comment "Rackspace monitoring" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 174.143.23.0/25 -m comment --comment "Rackspace monitoring" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 50.56.142.128/26 -m comment --comment "Rackspace monitoring" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 180.150.149.64/26 -m comment --comment "Rackspace monitoring" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 69.20.52.192/26 -m comment --comment "Rackspace monitoring" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 78.136.44.0/26 -m comment --comment "Rackspace monitoring" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 50.57.61.0/26 -m comment --comment "Rackspace monitoring" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 173.241.208.122/32 -m comment --comment "developer" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 204.232.241.45/32 -m comment --comment "developer" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 184.106.252.94/32 -m comment --comment "developer" -j ACCEPT 
-A RH-Firewall-1-INPUT -s 178.219.251.50/32 -m comment --comment "developer" -j ACCEPT 
-A RH-Firewall-1-INPUT -i lo -m comment --comment "localhost" -j ACCEPT 
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -m comment --comment "ping" -j ACCEPT 
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited 
-A fail2ban-ssh -j RETURN 
COMMIT
# Completed on Sat Sep 27 14:15:42 2014
1
  • I still don't think I have given you all the information. How do I get you the complete setup? Sep 28, 2014 at 15:46

1 Answer 1

1

The only duplicate definition is this:

-A INPUT -s 10.181.16.192/32 -p tcp -m tcp --dport 11211 -j ACCEPT

The same definition is also in the RH-Firewall-1-INPUT chain, which is used after the normal INPUT chain.

This is assuming that eth1 is for internal network and eth0 is the outside network.

There is one issue though: The misconfiguration of ICMP firewalling. Only Ping packets are passed through, which means that Path MTU discovery doesn't work correctly, and it might cause some issues. Also Destination Unreachable packets should be allowed.

2
  • Also if I spin up another web server with a different IP...it is able to communicate with the memcache server...Based on my very limited understanding of the firewall; I would think it would be blocked. Sep 29, 2014 at 14:57
  • Depends on if it connects to the internal network or external and internal networks. Sep 29, 2014 at 21:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .