2

I have a development server with the lamp stack running CentOS:

[Prompt]# cat /etc/redhat-release
CentOS release 5.8 (Final)

[Prompt]# cat /proc/version
Linux version 2.6.18-308.16.1.el5xen ([email protected]) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-52)) #1 SMP Tue Oct 2 22:50:05 EDT 2012

[Prompt]# yum info iptables
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirror.anl.gov
 * extras: centos.mirrors.tds.net
 * rpmfusion-free-updates: mirror.us.leaseweb.net
 * rpmfusion-nonfree-updates: mirror.us.leaseweb.net
 * updates: mirror.steadfast.net
Installed Packages
Name       : iptables
Arch       : x86_64
Version    : 1.3.5
Release    : 9.1.el5
Size       : 661 k
Repo       : installed
.... Snip....

When I run:

service --status-all

Part of the output looks like this:

.... Snip....
httpd (pid  xxxxx) is running...
Firewall is stopped.
Table: filter
Chain INPUT (policy DROP)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
....Snip....

iptables has been loaded to the kernel and is active as represented by the rules being displayed.

Checking just the iptables returns the rules just like status all does:

[Prompt]# service iptables status
Table: filter
Chain INPUT (policy DROP)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
.... Snip....

Starting or restarting iptables indicates that the iptables have been loaded to the kernel successfully:

[Prompt]# service iptables restart
Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: filter                    [  OK  ]
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules:                          [  OK  ]
Loading additional iptables modules: ip_conntrack_netbios_n[  OK  ]

[Prompt]# service iptables start
Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: filter                    [  OK  ]
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules:                          [  OK  ]
Loading additional iptables modules: ip_conntrack_netbios_n[  OK  ]

I've googled "Firewall is stopped." and read a number of iptables guides as well as the RHEL documentation, but no luck.

As far as I can tell, there isn't a "Firewall" service, so what is the line "Firewall is stopped." referring to?


EDIT - Here's some additional info.
iptables is working in spite of the "Firewall is stopped." output from service status.

I added a rule to iptables that restricted ssh access to only one IP address (not my IP address) and after restarting iptables, I couldn't log in.

I have an idea that the two items are output one after another in service --status-all is because the services are output alphabetically (just a guess).

So, can anyone explain why I see the "Firewall is stopped." is my service status output even though the iptables rules are in effect and working correctly?


Solution
The "Firewall is stopped." message appears if either iptables or ip6tables is turned off.

If both are off, the (same exact) message will appear twice (wouldn't it be nice if the message for ip6 indicated that it was referring to ip6).

You will also see the error message if the service is on, but you have an empty rules table (as happened in my case for ip6).

Information provided by @Alexander Janssen . See the answer for a link to the CentOS 5.8 default ip6 rule set.

2
  • What does chkconfig --list iptables say? Oct 3, 2012 at 20:28
  • Just installing CentOS 5.8 to verify what's going on with your machine. Oct 3, 2012 at 20:52

1 Answer 1

6

Edit: After having a chat with the OP we can state the following facts:

It refers to the services iptables and ip6tables.

The errormessage appears when the service ip6tables is on (by chkconfig), but doesn't have any rules.

I advice to set up default IPv6 rules as are given in the stock CentOS 5.8 installation. You may take this as a reference. This was taken from a stock 5.8 installation.

Hope everything is sorted out now :)

9
  • I rebooted and ran chkconfig --list iptables and runlevel. Runlevel is 3 and config is on for levels 2 through 5. I'm rebooting and will look at the /var/log/messages first thing. I'll add more info to the question shortly.
    – codewaggle
    Oct 3, 2012 at 21:13
  • OK, but this explains everything. If the service iptables is on, it's normal that you get an output like that it you run service --status-all. Oct 3, 2012 at 21:16
  • I think there is a misunderstanding, I want iptables to run and act as a firewall. You say maybe I forgot to stop iptables, why would I want to stop iptables? I want to know what service the "Firewall is stopped" output refers to. I just confirmed that the iptables are in effect even though it saya firewall is stopped, so they don't seem to be connected, see the edit to my question that I'll add after I finish this comment.
    – codewaggle
    Oct 3, 2012 at 21:52
  • So you want the firewall to be running and you wonder why it says "Firewall is stopped"? OK, no I figure. And I can verify your problem. Will update my answer soon. Gimme a few minutes. Oct 3, 2012 at 21:56
  • @codewaggle Can you tell me if you disabled the service ip6tables? If yes, I found the problem. Oct 3, 2012 at 21:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .