2

first time post to ServerFault so I'll try and get it right :)

I have multiple environments (e.g. prod, dev, test, etc) and I'm trying to write the IPTables file for my RHEL 6.6 servers which allows specific groups of machines to talk between those environments on defined ports.

Initially, having the rules for each different destination or source subnet defined on its own line worked - however the resultant iptables file is quite large. In an attempt to simplify/cleanup the ruleset I attempted to combine rules for multiple source or destination IPs utilising the same ports.

I've found a relevant ServerFault article on the subject IPTables Multiple Source IPs but the most highly rated example doesn't seem to be working for me.

For example, attempting to combine the following two rules:

-A INPUT  -i $INTERFACE -m conntrack --ctstate NEW,ESTABLISHED,RELATED -s $CV1 -p tcp --dport 8400:8403 -j ACCEPT -m comment --comment "Source 1"
-A INPUT  -i $INTERFACE -m conntrack --ctstate NEW,ESTABLISHED,RELATED -s $CV2 -p tcp --dport 8400:8403 -j ACCEPT -m comment --comment "Source 2"

Into this:

-A INPUT  -i $INTERFACE -m conntrack --ctstate NEW,ESTABLISHED,RELATED -s $CV1,$CV2 -p tcp --dport 8400:8403 -j ACCEPT -m comment --comment "Not Working!"

I also have rules which mix both multiple source and multiple destination IPs (similarly without success):

-A INPUT  -i $INTERFACE -s $FOO1,$FOO2 -d $FOO1,$FOO2 -p tcp --dport 8400:8403 -j ACCEPT
-A OUTPUT -o $INTERFACE -s $FOO1,$FOO2 -d $FOO1,$FOO2 -p tcp --dport 8400:8403 -j ACCEPT

Note: The /etc/sysconfig/iptables file is written by my custom config script (hence the $ variables), with the IPs being defined like this:

CV1=10.1.1.0/27
CV2=10.25.128.128/29
FOO1=10.1.30.140/30
FOO2=10.2.30.140/30

The traffic failures are picked up by the reject/log rules at the bottom of the IPTables file:

-A INPUT   -i $INTERFACE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "Packet Rejected. "
-A FORWARD -i $INTERFACE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "Packet Forward Rejected. "
-A OUTPUT  -o $INTERFACE -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "Packet Dropped. "
-A INPUT   -i $INTERFACE -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i $INTERFACE -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT  -o $INTERFACE -j REJECT --reject-with icmp-host-prohibited

Referring to the IPTables man page entry, it looks like it should work:

[!] -s, --source address[/mask][,...]

Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address. Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea. The mask can be either a network mask or a plain number, specifying the number of 1âs at the left side of the net- work mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A "!" argument before the address specification inverts the sense of the address. The flag --src is an alias for this option.
Multiple addresses can be specified, but this will expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D).

[!] -d, --destination address[/mask][,...]

Destination specification. See the description of the -s (source) flag for a detailed description of the syntax. The flag --dst is an alias for this option.

Is anyone able to enlighten me as to what I'm doing wrong here?

2

I copied your first combined iptables rule into my Ubuntu box and it worked for me:

iptables -A INPUT -i wlan0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -s 172.16.10.0/24,172.16.9.0/24 -p tcp --dport 8400:8403 -j ACCEPT -m comment --comment "Working! :)"

I received no output following that command, signifying success. I also ran your multi-source-destination command with success:

iptables -A INPUT -i wlan0 -s 172.16.10.0/24,172.16.9.0/24 -d 172.16.10.0/24,172.16.9.0/24 -p tcp --dport 8400:8403 -j ACCEPT

The only changes I made to your commands were for the interface and the source networks, since I did not use a script for testing your commands.

You posted your network variables in your question, but did not post your $INTERFACE variable. Is it missing from the script? Or perhaps inaccessible if this script is separate the from script wherein the variable is declared?

What is the output when you run your iptables script with the combined source/destination rules?

  • Hi Maff $INTERFACE equates to eth0. I'm able to successfully add the iptables commands, but they just don't appear to work. When the rules are on individual lines entered separately they're ok - but when entered together I keep getting "Packet rejected" blocks - like IPTables is not correctly interpreting the rule. – Tyderian Apr 4 '16 at 1:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.