0

I am not an iptables expert.

I have a use case to block all outgoing traffic that does not destined for either 10.0.0.0/8 or 167.114.0.0/16. I have two NIS servers (10.57.132.11, 10.57.132.40). I generated the below iptables ruleset which I thought would work, but if I run service iptables start, I am unable to also get ypbind to load. It times out on hitting the two NIS servers. I see nothing in the logs other than a timeout.

# Generated by iptables-save v1.4.7 on Fri Jul 17 11:08:39 2015
*filter
:INPUT ACCEPT [78622:10507056]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-I OUTPUT -d 10.57.132.11 -j ACCEPT
-I OUTPUT -d 10.57.132.40 -j ACCEPT
-I OUTPUT -d 167.114.0.0/16 -j ACCEPT 
-I OUTPUT -d 10.0.0.0/8 -j ACCEPT 
-P OUTPUT DROP

COMMIT
# Completed on Fri Jul 17 11:08:39 2015

Any thoughts on what I'm doing wrong? Thanks, Jack.

UPDATE: To clarify, ypbind binds when iptables is off, but won't bind when I turn the above ruleset on. Since it is only filtering OUTPUT and those rules seem correct, I don't understand the problem and I can't find anything useful in the logs.

6
  • The obvious one would be that portmapper isn't running?
    – HBruijn
    Jul 22, 2015 at 19:22
  • Portmapper is running normally: rpcbind (pid 1342) is running...
    – jackhamm
    Jul 22, 2015 at 20:14
  • Are your name servers within the ip-ranges specified?
    – HBruijn
    Jul 22, 2015 at 20:20
  • Yes - all the NS are in that 10.57.132.0 network.
    – jackhamm
    Jul 22, 2015 at 20:37
  • Time to put in a logging rule. Jul 22, 2015 at 22:02

1 Answer 1

1

tl;dr: iptables is really literal, don't forget localhost rules.

Okay! Got it. Michael Hampton gave me the idea to use a logging rule (this was my first time). So I did the following:

 Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  10.0.0.0/8           anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             10.0.0.0/8
ACCEPT     all  --  anywhere             167.114.0.0/16
ACCEPT     all  --  anywhere             nis1.example.com
ACCEPT     all  --  anywhere             nis2.example.com
LOGGING    all  --  anywhere             anywhere

Chain LOGGING (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            limit: avg 2/min burst 5 LOG level warning prefix `IPTables-Dropped: '
DROP       all  --  anywhere             anywhere

From there, I started iptables and then attempted to restart ypbind and immediately saw this:

Jul 22 22:53:04 host1 ypbind[9844]: Unable to register (YPBINDPROG, YPBINDVERS, udp).
Jul 22 22:53:31 host1 kernel: IPTables-Dropped: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=1476 DF PROTO=TCP SPT=18660 DPT=7606 WINDOW=2305 RES=0x00 ACK URGP=0 
Jul 22 22:53:50 host1 ypbind: NIS server for domain example is not responding.
Jul 22 22:54:01 host1 kernel: IPTables-Dropped: IN= OUT=lo SRC=127.0.0.1 DST=127.0.0.1 LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=1506 DF PROTO=TCP SPT=18660 DPT=7606 WINDOW=2305 RES=0x00 ACK URGP=0

OH NO! It's blocking localhost. I added that to the output rule and got:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  10.0.0.0/8           anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  localhost            localhost
ACCEPT     all  --  localhost            localhost
ACCEPT     all  --  localhost            localhost
ACCEPT     all  --  localhost            localhost
ACCEPT     all  --  anywhere             10.0.0.0/8
ACCEPT     all  --  anywhere             167.114.0.0/16
ACCEPT     all  --  anywhere             nis1.example.com
ACCEPT     all  --  anywhere             nis2.example.com
LOGGING    all  --  anywhere             anywhere

Chain LOGGING (1 references)
target     prot opt source               destination
LOG        all  --  anywhere             anywhere            limit: avg 2/min burst 5 LOG level warning prefix `IPTables-Dropped: '
DROP       all  --  anywhere             anywhere

One more ypbind restart and

Jul 22 22:54:38 host1 ypbind: NIS domain: example, NIS server: nis1.example.com

There you have it!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .