0

I have a VPS that I am using to host a Wordpress site for which I'd like to restrict access. The end goal is to restrict SSH access to two IPs, and restrict everything inbound but the ports specified in the rules I have below. They don't seem to be saving while rebooting the server (reboot command). The rules seem to apply after being run, but not after server reboot. I have verified they are being written to /etc/sysconfig/iptables. Here is what I am adding to the file at the console:

iptables -F; iptables -X; iptables -Z

iptables -A INPUT -s X.X.X.X -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s X.X.X.X -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p udp --dport 123 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

iptables-save > /etc/sysconfig/iptables

Here is what is actually being written:

# Generated by iptables-save v1.4.7 on Wed Nov 30 16:01:17 2016
*mangle
:PREROUTING ACCEPT [572:59036]
:INPUT ACCEPT [572:59036]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [486:358945]
:POSTROUTING ACCEPT [483:358793]
-A PREROUTING -p tcp -m tcp --sport 110 -j TOS --set-tos 0x04/0xff
-A PREROUTING -p udp -m udp --sport 110 -j TOS --set-tos 0x04/0xff
-A PREROUTING -p tcp -m tcp --sport 1110 -j TOS --set-tos 0x04/0xff
-A PREROUTING -p udp -m udp --sport 1110 -j TOS --set-tos 0x04/0xff
-A PREROUTING -p tcp -m tcp --sport 465 -j TOS --set-tos 0x04/0xff
-A PREROUTING -p udp -m udp --sport 465 -j TOS --set-tos 0x04/0xff
-A PREROUTING -p tcp -m tcp --sport 993 -j TOS --set-tos 0x04/0xff
-A PREROUTING -p udp -m udp --sport 993 -j TOS --set-tos 0x04/0xff
-A PREROUTING -p tcp -m tcp --sport 995 -j TOS --set-tos 0x04/0xff
-A PREROUTING -p udp -m udp --sport 995 -j TOS --set-tos 0x04/0xff
-A PREROUTING -p tcp -m tcp --sport 20 -j TOS --set-tos 0x08/0xff
-A PREROUTING -p udp -m udp --sport 20 -j TOS --set-tos 0x08/0xff
-A PREROUTING -p tcp -m tcp --sport 21 -j TOS --set-tos 0x08/0xff
-A PREROUTING -p udp -m udp --sport 21 -j TOS --set-tos 0x08/0xff
-A PREROUTING -p tcp -m tcp --sport 22 -j TOS --set-tos 0x10/0xff
-A PREROUTING -p udp -m udp --sport 22 -j TOS --set-tos 0x10/0xff
-A PREROUTING -p tcp -m tcp --sport 25 -j TOS --set-tos 0x10/0xff
-A PREROUTING -p udp -m udp --sport 25 -j TOS --set-tos 0x10/0xff
-A PREROUTING -p tcp -m tcp --sport 53 -j TOS --set-tos 0x10/0xff
-A PREROUTING -p udp -m udp --sport 53 -j TOS --set-tos 0x10/0xff
-A PREROUTING -p tcp -m tcp --sport 80 -j TOS --set-tos 0x10/0xff
-A PREROUTING -p udp -m udp --sport 80 -j TOS --set-tos 0x10/0xff
-A PREROUTING -p tcp -m tcp --sport 443 -j TOS --set-tos 0x10/0xff
-A PREROUTING -p udp -m udp --sport 443 -j TOS --set-tos 0x10/0xff
-A PREROUTING -p tcp -m tcp --sport 512:65535 -j TOS --set-tos 0x00/0xff
-A PREROUTING -p udp -m udp --sport 512:65535 -j TOS --set-tos 0x00/0xff
-A POSTROUTING -p tcp -m tcp --dport 110 -j TOS --set-tos 0x04/0xff
-A POSTROUTING -p udp -m udp --dport 110 -j TOS --set-tos 0x04/0xff
-A POSTROUTING -p tcp -m tcp --dport 1110 -j TOS --set-tos 0x04/0xff
-A POSTROUTING -p udp -m udp --dport 1110 -j TOS --set-tos 0x04/0xff
-A POSTROUTING -p tcp -m tcp --dport 465 -j TOS --set-tos 0x04/0xff
-A POSTROUTING -p udp -m udp --dport 465 -j TOS --set-tos 0x04/0xff
-A POSTROUTING -p tcp -m tcp --dport 993 -j TOS --set-tos 0x04/0xff
-A POSTROUTING -p udp -m udp --dport 993 -j TOS --set-tos 0x04/0xff
-A POSTROUTING -p tcp -m tcp --dport 995 -j TOS --set-tos 0x04/0xff
-A POSTROUTING -p udp -m udp --dport 995 -j TOS --set-tos 0x04/0xff
-A POSTROUTING -p tcp -m tcp --dport 20 -j TOS --set-tos 0x08/0xff
-A POSTROUTING -p udp -m udp --dport 20 -j TOS --set-tos 0x08/0xff
-A POSTROUTING -p tcp -m tcp --dport 21 -j TOS --set-tos 0x08/0xff
-A POSTROUTING -p udp -m udp --dport 21 -j TOS --set-tos 0x08/0xff
-A POSTROUTING -p tcp -m tcp --dport 22 -j TOS --set-tos 0x10/0xff
-A POSTROUTING -p udp -m udp --dport 22 -j TOS --set-tos 0x10/0xff
-A POSTROUTING -p tcp -m tcp --dport 25 -j TOS --set-tos 0x10/0xff
-A POSTROUTING -p udp -m udp --dport 25 -j TOS --set-tos 0x10/0xff
-A POSTROUTING -p tcp -m tcp --dport 53 -j TOS --set-tos 0x10/0xff
-A POSTROUTING -p udp -m udp --dport 53 -j TOS --set-tos 0x10/0xff
-A POSTROUTING -p tcp -m tcp --dport 80 -j TOS --set-tos 0x10/0xff
-A POSTROUTING -p udp -m udp --dport 80 -j TOS --set-tos 0x10/0xff
-A POSTROUTING -p tcp -m tcp --dport 443 -j TOS --set-tos 0x10/0xff
-A POSTROUTING -p udp -m udp --dport 443 -j TOS --set-tos 0x10/0xff
-A POSTROUTING -p tcp -m tcp --dport 512:65535 -j TOS --set-tos 0x00/0xff
-A POSTROUTING -p udp -m udp --dport 512:65535 -j TOS --set-tos 0x00/0xff
COMMIT
# Completed on Wed Nov 30 16:01:17 2016
# Generated by iptables-save v1.4.7 on Wed Nov 30 16:01:17 2016
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -s X.X.X.X/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s X.X.X.X/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p udp -m udp --dport 123 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
COMMIT
# Completed on Wed Nov 30 16:01:17 2016

It seems the mangle is being appended prior to the filter. Does this make a difference?

Output for iptables -L -v -n is the following:

Chain INPUT (policy DROP 37 packets, 1951 bytes)
 pkts bytes target     prot opt in     out     source               destination
 1029 86325 ACCEPT     tcp  --  *      *       X.X.X.X              0.0.0.0/0           tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       X.X.X.X              0.0.0.0/0           tcp dpt:22
  632  316K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
   85 40646 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    2   128 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:123
    9   678 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:53
    2   100 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:53

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 1529 packets, 484K bytes)
 pkts bytes target     prot opt in     out     source               destination

If I restart the service (but not whole server) with service iptables restart everything sticks and the rules seem to still be in effect. However, if I do a server restart with reboot, everything from /etc/sysconfig/iptables is still there, however the output from iptables -L -v -n is very different now with thousands of lines. My rules also seem to no longer apply, although everything in the file still looks the same.

I believe the runlevel is also appropriately set:

[root@s1 ~]# chkconfig --list iptables
iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off

So again, my questions are: 1. Why aren't the rules applying after server restart, although they apply and seem to stick after service restart? How can I get them to apply? 2. Does the mangle part in the iptables file make a difference? Is it required in this case? 3. Why is the iptables -L -v -n output different after restart? It only seems to change after server restart and not service restart.

Any ideas and help is greatly appreciated.

  • Any update anyone? I would appreciate a reply. – CiprianD Dec 4 '16 at 18:00
  • Are you editing /etc/sysconfig/iptables manually or using the command line? ie iptables -A INPUT -p tcp --dport ssh -s 10.10.10.10 -m state --state NEW,ESTABLISHED -j ACCEPT – Anthony Fornito Dec 6 '16 at 19:31
  • Also im not sure if it matters however in your config above you have 2 entries for tcp going to port 22 might want to check that – Anthony Fornito Dec 6 '16 at 19:31
  • I am using the command line to enter the rules. The 2 entries have separate IPs, one for each that is allowed to SSH. The first formatted text at the top is exactly what i am copy/pasting into the terminal. Well with the exception of x.x.x.x. Obviously those get substituted for the actual IPs. – CiprianD Dec 6 '16 at 21:21
0

Sounds like there is another firewall running. Check for any firewall services like Shorewall, UFW etc, or if any other services like Webmin interfere with your rules settings.

0

I'm very novice with Unix but in my case I found interesting to create my iptables rules into a file and then run it from :

/etc/network/interfaces

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.