11

I installed a minimal CentOS 7 version on a development server to virtualize some linux guests with kvm/qemu.

To use iptables instead of firewalld I install iptables-service and do:

systemctl stop firewalld
systemctl mask firewalld
systemctl enable iptables
systemctl start iptables

SELinux is disabled by editing /etc/sysconfig/selinux.

My rules for iptables are the following:

iptables -Z
iptables -F
iptables -X
iptables -t nat -Z
iptables -t nat -F
iptables -t nat -X
iptables -t nat -A POSTROUTING -o enp6s0 -j MASQUERADE
iptables -A FORWARD -i enp6s0 -o virbr0 -j ACCEPT

Now i save my settings with the following command:

iptables-save > /etc/sysconfig/iptables

My iptables-file looks:

# Generated by iptables-save v1.4.21 on Thu Aug 20 10:46:40 2015
*mangle
:PREROUTING ACCEPT [16736:10889078]
:INPUT ACCEPT [1063:106860]
:FORWARD ACCEPT [15679:10784186]
:OUTPUT ACCEPT [570:71275]
:POSTROUTING ACCEPT [15728:10809742]
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Thu Aug 20 10:46:40 2015
# Generated by iptables-save v1.4.21 on Thu Aug 20 10:46:40 2015
*filter
:INPUT ACCEPT [868:81772]
:FORWARD ACCEPT [8328:7311589]
:OUTPUT ACCEPT [233:32016]
-A FORWARD -i enp6s0 -o virbr0 -j ACCEPT
COMMIT
# Completed on Thu Aug 20 10:46:40 2015
# Generated by iptables-save v1.4.21 on Thu Aug 20 10:46:40 2015
*nat
:PREROUTING ACCEPT [1308:86998]
:INPUT ACCEPT [77:12475]
:OUTPUT ACCEPT [1:72]
:POSTROUTING ACCEPT [1228:74319]
-A POSTROUTING -o enp6s0 -j MASQUERADE
COMMIT
# Completed on Thu Aug 20 10:46:40 2015

A quick check to see if my rules are correct for now:

[root@dev1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

But after rebooting the server the iptables rules looks like:

[root@dev1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             10.0.1.0/24          ctstate RELATED,ESTABLISHED
ACCEPT     all  --  10.0.1.0/24          anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpc

I don't understand where the other rules come from.

When calling iptables-restore -c /etc/sysconfig/iptables the expected rules are displayed.

It seems that the saved rules are not loaded at boot-time or that the "default"-rules are not flushed or whatever.

What is the problem here ??? I'm slowly getting gray hairs ...


Thanks for your quick responses :)

As mentioned above the iptables-services was installed by me:

[root@dev1 ~]# rpm -aq iptables-services
iptables-services-1.4.21-13.el7.x86_64

Enabling the service with systemctl enable iptables.service instead of using systemctl enable iptables seems to make no difference because the same service file is linked:

[root@dev1 ~]# systemctl disable iptables
rm '/etc/systemd/system/basic.target.wants/iptables.service'
[root@dev1 ~]# systemctl enable iptables.service
ln -s '/usr/lib/systemd/system/iptables.service' '/etc/systemd/system/basic.target.wants/iptables.service'

This is the content of iptables file after calling /usr/libexec/iptables/iptables.init save

[root@develcluster1 ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.21 on Fri Aug 21 14:34:04 2015
*nat
:PREROUTING ACCEPT [351490:22546787]
:INPUT ACCEPT [15751:2400243]
:OUTPUT ACCEPT [324:21186]
:POSTROUTING ACCEPT [304860:18293418]
-A POSTROUTING -o enp6s0 -j MASQUERADE
COMMIT
# Completed on Fri Aug 21 14:34:04 2015
# Generated by iptables-save v1.4.21 on Fri Aug 21 14:34:04 2015
*filter
:INPUT ACCEPT [505048:69178501]
:FORWARD ACCEPT [55815086:22035726185]
:OUTPUT ACCEPT [325986:56595531]
-A FORWARD -i enp6s0 -o virbr0 -j ACCEPT
COMMIT
# Completed on Fri Aug 21 14:34:04 2015
# Generated by iptables-save v1.4.21 on Fri Aug 21 14:34:04 2015
*mangle
:PREROUTING ACCEPT [109215513:66867793592]
:INPUT ACCEPT [505243:69203589]
:FORWARD ACCEPT [108710264:66798590873]
:OUTPUT ACCEPT [326323:56634790]
:POSTROUTING ACCEPT [109036066:66855179944]
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Fri Aug 21 14:34:04 2015

After reboot a call to iptables -L don't show my saved rules:

[root@dev1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             10.0.1.0/24          ctstate RELATED,ESTABLISHED
ACCEPT     all  --  10.0.1.0/24          anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpc

Maybe I'm doing something fundamental wrong. But every thread i read do this the same way and it should work.

If you need more information please tell me.

Meanwhile, I helped me by calling a small script that i must call after each reboot.

#!/bin/sh

iptables -Z
iptables -F
iptables -X
iptables -t nat -Z
iptables -t nat -F
iptables -t nat -X
iptables -t nat -A POSTROUTING -o enp6s0 -j MASQUERADE
iptables -A FORWARD -i enp6s0 -o virbr0 -j ACCEPT

iptables --flush
iptables-restore -c /etc/sysconfig/iptables

Thats not sexy but works so far. But could not be the final solution.

13

i think you need to enable the service with:

systemctl enable iptables.service

and you need to run the iptables init script to save your rules like this:

/usr/libexec/iptables/iptables.init save

3

Ensure you have the iptables-services package installed:

rpm -aq iptables-services

If not install it:

yum install iptables-services

You can then use the service command to control it just like with previous versions of CentOS:

service iptables save

The save, stop, start, restart commands will all work and it should load on boot.

  • i have the iptables command. but ` rpm -aq iptables-services` does not output anything. What does that mean? – Saad Masood Sep 7 '15 at 8:35
  • rpm -aq by itself will list all packages installed on a system and their version. rpm -aq <package> will print out information about the defined package if it's installed. If rpm -aq iptables-services returns nothing that means the 'iptables-services' package is not installed. – Gene Sep 7 '15 at 13:49
  • If you have a question specific to CentOS 7 and AWS then you should post a whole new question, not make comments on an unrelated answer. I have no idea what packages Amazon keeps in their repositories, but I can tell you that iptables-services is available in the standard, base CentOS 7 repository. – Gene Sep 7 '15 at 14:47
1

I got around this by adding 'service iptables stop \ iptables --flush' command appended to the bottom /etc/rc.d/rc.local

My environment was Centos 7 KVM and my issue was that libvirt would re-populate the iptables on a reboot - blocking access to my virtual machines.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.