Can someone please take a look at this iptables data and tell me what's wrong with it?
The paste 24h has been a nightmare, I couldn't even SSH to my server, and the only way I could manage to get the server back online was to use an KVM console and disable the firewall (ie. service iptables stop
)
The worst thing is: I have to re-run this command service iptables stop
every like 15-30 minutes to get the server back online, this is crazy!
# Generated by iptables-save v1.3.5 on Sun Dec 8 21:56:04 2013
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:ALLOWIN - [0:0]
:ALLOWOUT - [0:0]
:INVALID - [0:0]
:INVDROP - [0:0]
:LOCALINPUT - [0:0]
:LOCALOUTPUT - [0:0]
:LOGDROPIN - [0:0]
:LOGDROPOUT - [0:0]
:acctboth - [0:0]
-A INPUT -j acctboth
-A INPUT -i eth0 -j LOCALINPUT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -p tcp -j INVALID
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2077 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2078 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2082 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2083 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2086 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2087 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2095 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2096 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 2382 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 26 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 30000:35000 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 12001:12009 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 9418 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8001 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8002 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 6379 -j ACCEPT
-A INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 119 -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 20 -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 21 -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 2382 -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 26 -j ACCEPT
-A INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 119 -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 0 -m limit --limit 1/sec -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -i eth0 -j LOGDROPIN
-A OUTPUT -j acctboth
-A OUTPUT -o eth0 -j LOCALOUTPUT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --sport 53 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --sport 53 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth0 -p tcp -j INVALID
-A OUTPUT -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 9418 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 37 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 43 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 113 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 873 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 2087 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 2089 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 2703 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 2382 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 26 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 30000:35000 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 12001 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 12009 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 6379 -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 119 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 20 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 21 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 113 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 123 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 873 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 6277 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 2382 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 26 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m state --state NEW -m udp --dport 119 -j ACCEPT
-A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 0 -m limit --limit 1/sec -j ACCEPT
-A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j ACCEPT
-A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A OUTPUT -o eth0 -j LOGDROPOUT
-A ALLOWIN -s 41.228.96.0/255.255.255.0 -i eth0 -j ACCEPT
-A ALLOWIN -s 41.228.96.65 -i eth0 -j ACCEPT
-A ALLOWIN -s 209.51.153.82 -i eth0 -j ACCEPT
-A ALLOWOUT -d 41.228.96.0/255.255.255.0 -o eth0 -j ACCEPT
-A ALLOWOUT -d 41.228.96.65 -o eth0 -j ACCEPT
-A ALLOWOUT -d 209.51.153.82 -o eth0 -j ACCEPT
-A INVALID -m state --state INVALID -j INVDROP
-A INVALID -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j INVDROP
-A INVALID -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j INVDROP
-A INVALID -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j INVDROP
-A INVALID -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j INVDROP
-A INVALID -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j INVDROP
-A INVALID -p tcp -m tcp --tcp-flags FIN,ACK FIN -j INVDROP
-A INVALID -p tcp -m tcp --tcp-flags PSH,ACK PSH -j INVDROP
-A INVALID -p tcp -m tcp --tcp-flags ACK,URG URG -j INVDROP
-A INVALID -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j INVDROP
-A INVDROP -j DROP
-A LOCALINPUT -i eth0 -j ALLOWIN
-A LOCALOUTPUT -o eth0 -j ALLOWOUT
-A LOGDROPIN -p tcp -m tcp --dport 67 -j DROP
-A LOGDROPIN -p udp -m udp --dport 67 -j DROP
-A LOGDROPIN -p tcp -m tcp --dport 68 -j DROP
-A LOGDROPIN -p udp -m udp --dport 68 -j DROP
-A LOGDROPIN -p tcp -m tcp --dport 111 -j DROP
-A LOGDROPIN -p udp -m udp --dport 111 -j DROP
-A LOGDROPIN -p tcp -m tcp --dport 113 -j DROP
-A LOGDROPIN -p udp -m udp --dport 113 -j DROP
-A LOGDROPIN -p tcp -m tcp --dport 135:139 -j DROP
-A LOGDROPIN -p udp -m udp --dport 135:139 -j DROP
-A LOGDROPIN -p tcp -m tcp --dport 445 -j DROP
-A LOGDROPIN -p udp -m udp --dport 445 -j DROP
-A LOGDROPIN -p tcp -m tcp --dport 513 -j DROP
-A LOGDROPIN -p udp -m udp --dport 513 -j DROP
-A LOGDROPIN -p tcp -m tcp --dport 520 -j DROP
-A LOGDROPIN -p udp -m udp --dport 520 -j DROP
-A LOGDROPIN -p tcp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *TCP_IN Blocked* "
-A LOGDROPIN -p udp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *UDP_IN Blocked* "
-A LOGDROPIN -p icmp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *ICMP_IN Blocked* "
-A LOGDROPIN -j DROP
-A LOGDROPOUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 30/min -j LOG --log-prefix "Firewall: *TCP_OUT Blocked* " --log-uid
-A LOGDROPOUT -p udp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *UDP_OUT Blocked* " --log-uid
-A LOGDROPOUT -p icmp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *ICMP_OUT Blocked* " --log-uid
-A LOGDROPOUT -j DROP
-A acctboth -s 111.11.11.146 -i ! lo -p tcp -m tcp --dport 80
-A acctboth -d 111.11.11.146 -i ! lo -p tcp -m tcp --sport 80
-A acctboth -s 111.11.11.146 -i ! lo -p tcp -m tcp --dport 25
-A acctboth -d 111.11.11.146 -i ! lo -p tcp -m tcp --sport 25
-A acctboth -s 111.11.11.146 -i ! lo -p tcp -m tcp --dport 110
-A acctboth -d 111.11.11.146 -i ! lo -p tcp -m tcp --sport 110
-A acctboth -s 111.11.11.146 -i ! lo -p icmp
-A acctboth -d 111.11.11.146 -i ! lo -p icmp
-A acctboth -s 111.11.11.146 -i ! lo -p tcp
-A acctboth -d 111.11.11.146 -i ! lo -p tcp
-A acctboth -s 111.11.11.146 -i ! lo -p udp
-A acctboth -d 111.11.11.146 -i ! lo -p udp
-A acctboth -s 111.11.11.146 -i ! lo
-A acctboth -d 111.11.11.146 -i ! lo
-A acctboth -s 111.11.11.160 -i ! lo -p tcp -m tcp --dport 80
-A acctboth -d 111.11.11.160 -i ! lo -p tcp -m tcp --sport 80
-A acctboth -s 111.11.11.160 -i ! lo -p tcp -m tcp --dport 443
-A acctboth -d 111.11.11.160 -i ! lo -p tcp -m tcp --sport 443
-A acctboth -s 111.11.11.160 -i ! lo -p tcp -m tcp --dport 25
-A acctboth -d 111.11.11.160 -i ! lo -p tcp -m tcp --sport 25
-A acctboth -s 111.11.11.160 -i ! lo -p tcp -m tcp --dport 110
-A acctboth -d 111.11.11.160 -i ! lo -p tcp -m tcp --sport 110
-A acctboth -s 111.11.11.160 -i ! lo -p icmp
-A acctboth -d 111.11.11.160 -i ! lo -p icmp
-A acctboth -s 111.11.11.160 -i ! lo -p tcp
-A acctboth -d 111.11.11.160 -i ! lo -p tcp
-A acctboth -s 111.11.11.160 -i ! lo -p udp
-A acctboth -d 111.11.11.160 -i ! lo -p udp
-A acctboth -s 111.11.11.160 -i ! lo
-A acctboth -d 111.11.11.160 -i ! lo
-A acctboth -i ! lo
COMMIT
# Completed on Sun Dec 8 21:56:04 2013
# Generated by iptables-save v1.3.5 on Sun Dec 8 21:56:04 2013
*nat
:PREROUTING ACCEPT [52:2991]
:POSTROUTING ACCEPT [131:10103]
:OUTPUT ACCEPT [131:10103]
COMMIT
# Completed on Sun Dec 8 21:56:04 2013
# Generated by iptables-save v1.3.5 on Sun Dec 8 21:56:04 2013
*mangle
:PREROUTING ACCEPT [1314:156437]
:INPUT ACCEPT [1314:156437]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1741:1844557]
:POSTROUTING ACCEPT [1741:1844557]
COMMIT
# Completed on Sun Dec 8 21:56:04 2013
The KVM console showed a lot of errors like this
Clearly the errors are caused by these lines:
-A LOGDROPIN -p tcp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *TCP_IN Blocked* "
-A LOGDROPIN -p udp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *UDP_IN Blocked* "
-A LOGDROPIN -p icmp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *ICMP_IN Blocked* "
-A LOGDROPIN -j DROP
-A LOGDROPOUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 30/min -j LOG --log-prefix "Firewall: *TCP_OUT Blocked* " --log-uid
-A LOGDROPOUT -p udp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *UDP_OUT Blocked* " --log-uid
-A LOGDROPOUT -p icmp -m limit --limit 30/min -j LOG --log-prefix "Firewall: *ICMP_OUT Blocked* " --log-uid
-A LOGDROPOUT -j DROP
But I have absolutely no idea why this is happening and how to fix this!!!
PS. As you can tell, I'm a total newbie at this firewall rules thing.
I'm running CentOS 6.4 + Apache 2.2.15, I'm not using cPanel anymore on this server.