3

I'm having this definition file:

*filter

:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:Firewall-INPUT - [0:0]
-A INPUT -j Firewall-INPUT
-A FORWARD -j Firewall-INPUT
-A Firewall-INPUT -i lo -j ACCEPT
-A Firewall-INPUT -p icmp --icmp-type echo-reply -j ACCEPT
-A Firewall-INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
-A Firewall-INPUT -p icmp --icmp-type time-exceeded -j ACCEPT

# Ping
-A Firewall-INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Accept any established connections
-A Firewall-INPUT -m conntrack --ctstate  ESTABLISHED,RELATED -j ACCEPT

# Enable the traffic between the nodes of the cluster
-A Firewall-INPUT -s 10.0.1.1 -j ACCEPT

# Allow connections from docker container
-A Firewall-INPUT -i docker0 -j ACCEPT

# Accept ssh, http, https and git
-A Firewall-INPUT -m conntrack --ctstate NEW -m multiport -p tcp --dports 22,2222,80,443 -j ACCEPT

# Log and drop everything else
-A Firewall-INPUT -j LOG
-A Firewall-INPUT -j REJECT --reject-with icmp-host-prohibited

COMMIT

I then invoke iptables-restore with these rules:

/sbin/iptables-restore < /tmp/iptables-rules-save

After that, I run iptables -L and get this:

Chain INPUT (policy DROP)
target     prot opt source               destination
Firewall-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
Firewall-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain Firewall-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  10.0.1.1             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            ctstate NEW multiport dports ssh,EtherNet/IP-1,http,https
LOG        all  --  anywhere             anywhere            LOG level warning
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

As you can see it is adding a dangerous rule that accept all packets from any source to any interface on the server.

What is the wrong thing with my setup that lead to that? How to fix it?

P/S: I run this one on a Digital Ocean CentOS 6.5 droplet

  • This is why I always recommend using iptables-save to view the current iptables rules. iptables-save will not omit relevant information from the rules. Additionally the output will be in a format suitable for loading into the kernel using the iptables-restore or iptables command. – kasperd Feb 4 '15 at 23:33
4

The default output for iptables -L doesn't show you interfaces, so it doesn't show you the exact rule. Try running iptables -L -v to get the interface included in the output - the destination column is a network address, not an interface. The output with -v will show the exact rules you've created.

| improve this answer | |
  • Thanks a ton man. I specify the -v and can see that the 2 interface involved is lo and docker0 which is perfectly ok. – Phuong Nguyen Dec 16 '14 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.