0

My iptables just suddenly became unable to be edited. It still runs fine but I am unable to do anything to the configuration such as opening or closing ports.

I keep getting this error:

Configuration failed
/usr/sbin/lokkit -f -v --enabled --trust=eth+ --service=ssh --service=http --service=ftp --addmodule=nf_conntrack_ftp --service=https --port=8080:tcp --port=8080:udp --port=6060:tcp --port=6060:udp --port=21:tcp --port=21:udp --port=20:tcp --port=20:udp --port=3306:tcp --port=3306:udp --port=3389:tcp --port=3389:udp
Traceback (most recent call last):
  File "/usr/sbin/lokkit", line 74, in <module>
    ip6t_status, log) = fw_lokkit.updateFirewall(config, old_config)
  File "/usr/share/system-config-firewall/fw_lokkit.py", line 167, in updateFirewall
    ip4tables_conf.write()
  File "/usr/share/system-config-firewall/fw_iptables.py", line 188, in write
    self._write(fd, key, self.p_config[key])
KeyError: 'IPTABLES_MODULES'

My iptables file

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth+ -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 8080 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 6060 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 6060 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 20 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 20 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 3306 -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -i eth+ -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

Can anybody tell me what this error is and the solution to this?

  • Can you edit iptables with the 'iptables' command? – Envite Apr 22 '14 at 14:06
  • I could but nothing would be reflected onto it. Changes are not updated. – Hong Yi Apr 22 '14 at 14:40
  • Of course not. Iptables lives into the kernel, not into some file. – Envite Apr 22 '14 at 14:44
  • It's not reflected even after I restart it. Normally changes would be reflected after service iptables reload but now nothing works. – Hong Yi Apr 22 '14 at 14:46
  • reload should not modify any files, but read from the files to reconfigure the real system inside the kernel – Envite Apr 22 '14 at 14:48
1

Your issue does not lie with iptables, but with the lokkit application you use to manage it. I suggest you to remove lokkit from your system and install it again, and if that does not work, drop it definitely and make things properly, using the iptables command and maybe some scripting.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.