5

I can run iptables-save and dump output to stdout but if I redirect to a file - the file is empty:

    [root@nhd-vlx2 tmp]# iptables-save  
    # Generated by iptables-save v1.4.7 on Sun Dec 18 15:11:42 2011
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [90971:17757587]
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
    -A INPUT -p icmp -j ACCEPT 
    -A INPUT -i lo -j ACCEPT 
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 9090:9999 -j ACCEPT 
    -A INPUT -j REJECT --reject-with icmp-host-prohibited 
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited 
    COMMIT
    # Completed on Sun Dec 18 15:11:42 2011
    [root@nhd-vlx2 tmp]# iptables-save  > save
    [root@nhd-vlx2 tmp]# cat save
    [root@nhd-vlx2 tmp]# 
    [root@nhd-vlx2 tmp]# 

Piping works (iptables-save | cat), and so saving to file through tee works too, but why would iptables-save not allows saving to a file?

The only reason I can think is that this machine may be infected by a virus (an attempt to weaken a firewall)

2
  • let me guess - Red Hat/CentOS?
    – Rilindo
    Dec 18, 2011 at 21:06
  • Centos6, this used to be fine on centos5 (but as you suggest, maybe selinux s getting in the way)
    – nhed
    Dec 18, 2011 at 21:43

3 Answers 3

5

Long shot, but:

Somebody else posted a similar problem in another forum. As it turns out, the SELinux context is wrong.

Run ls -laZ on iptables-multi. It should return with:

-rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /sbin/iptables-multi

All the other iptables files are symlinked to it:

[root@cacti tmp]# ls -laZ /sbin/iptables*
lrwxrwxrwx. root root system_u:object_r:bin_t:s0       /sbin/iptables -> iptables-multi
-rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /sbin/iptables-multi
lrwxrwxrwx. root root system_u:object_r:bin_t:s0       /sbin/iptables-restore -> iptables-multi
lrwxrwxrwx. root root system_u:object_r:bin_t:s0       /sbin/iptables-save -> iptables-multi

If the SELinux context is not correct, change it with the chcon command on the main file:

chcon -u system_u -t iptables_exec_t /sbin/iptables-multi

If the SELinux context on the symlinks are not correct, fix them using the above command (although this time with the bin_t type)

8
  • As far as I can tell the output was the same as yours: rwxr-xr-x. root root system_u:object_r:iptables_exec_t:s0 /sbin/iptables-multi ... and the symlinks also look the same lrwxrwxrwx. root root system_u:object_r:bin_t:s0 /sbin/iptables-save -> iptables-multi
    – nhed
    Dec 18, 2011 at 21:38
  • Disabling selinux wth echo 0 >/selinux/enforce makes iptables-save behave as expected ... so what is selinux trying to save me from?
    – nhed
    Dec 18, 2011 at 21:46
  • The default behavior of selinux wouldn't cause this. You mentioned that this used to be Centos 5 - was this an upgrade or a complete rebuild?
    – Rilindo
    Dec 18, 2011 at 22:39
  • At any event, I would probably suggest do a cat on /var/log/audit/audit.log and pipe it to audit2allow to see if it notices anything odd when you attempted to save iptables-save to file with a redirect
    – Rilindo
    Dec 18, 2011 at 23:05
  • This a fresh install of Centos6 seen both on a VM and a machine that was formatted+installed. (2) I may have mislead a little, its quite possible that I have disabled selinux on my Centos5.5 host. (3) audit2allow shows allow iptables_t vmblock_t:file write;
    – nhed
    Dec 18, 2011 at 23:58
0

As per Rilindo comment, if you are on RedHat the docs mention:

~]# /sbin/service iptables save 
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]
2
  • service iptables save is a wrapper around iptables-save. The difference is that you can use iptables-save to write to any file, while service iptables save writes to /etc/sysconfig/iptables-save and /etc/sysconfig/iptables by default.
    – Rilindo
    Dec 18, 2011 at 21:32
  • @Rilindo - Yes, I understand but this would tell us if the iptables is totally ok (which sounds like it is as tee/cat work just redirection fails). So could the shell be globbing the command somehow?
    – Wayne
    Dec 18, 2011 at 21:42
0

The iptables-save tries to set the correct selinux security context on a minimalistic centos-7.

I looked at the error, and it appears to fail because the utilities for changing selinux context are not installed (via dependency?).

The following fixed it for me:

yum -y install policycoreutils

After this, the following worked okay:

/sbin/service iptables save
2
  • The question was about the iptables-save executable.
    – nhed
    Dec 5, 2016 at 23:41
  • yes - and iptables-save will fail if policycoreutils is missing (tested on centos 7)
    – vpathak
    Dec 7, 2016 at 16:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .