I have a script with some iptables rules in it. When I execute this script on another host using 'ssh', then this call blocks for approx. 2 hours.

This is the contents of the script. The idea is to block all traffic, except ssh, http(s), icmp and broadcast udp-discovery :

iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dport 22,80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p udp -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A OUTPUT -p tcp -m multiport --sport 22,80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A OUTPUT -p udp -j ACCEPT

I execute the script via this call:

sshpass -p <pwd> ssh root@<host> '/bin/sh -s' < script.sh

And most of the time (not always), this call hangs and is interrupted after 7300 sec. I have done a s-trace. It also seems that this only happens when setting some iptables rules, executing any other command over ssh shows no problem although the s-trace is the same, but the interrupt happens after 0,1 sec.

0.000092 wait4(4075588, 0x7ffd2d32bdec, WNOHANG, NULL) = 0
     0.000086 pselect6(4, [3], NULL, NULL, NULL, {[], 8}) = ? ERESTARTNOHAND (To be restarted if no handler)
  7303.455216 --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4075588, si_uid=1005, si_status=255, si_utime=2, si_stime=0} ---
     0.000332 rt_sigreturn({mask=[CHLD]}) = -1 EINTR (Interrupted system call)
     0.000328 wait4(4075588, [{WIFEXITED(s) && WEXITSTATUS(s) == 255}], WNOHANG, NULL) = 4075588
     0.000423 exit_group(255)           = ?
     0.000645 +++ exited with 255 +++

The strange thing is also that the iptables rules are correctly set after 7300 seconds, BUT an extra rule is added: ACCEPT all -- anywhere anywhere for the INPUT and OUTPUT chains.

Can someone give some explanation about this behaviour ?


New contributor
Dimitri is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • The is absolutely no guarantee that all the iptables commands will be transferred and executed. Imagine that the script is transmitted in two packets and the split is after iptables -P FORWARD DROP - what do you think will happen? – kupson May 4 at 11:10
  • So the reason might be the same as described in serverfault.com/questions/105515/iptables-causing-ssh-to-stall – Dimitri May 4 at 11:39
  • Oh yeah - you need more ICMP types allowed too. Don't send line-by-line to remote SSH shell as it will never be reliable. Save script somewhere on the remote side and execute it as one command. – kupson May 4 at 14:20

Your Answer

Dimitri is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.