1

When trying to update iptables in CentOS, this is an error I receive:

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Will "-w" option really work? where in the following script can I add it?

#!/bin/bash
# Purpose: Block all traffic from AFGHANISTAN (af) and CHINA (CN). Use ISO code. #
# See url for more info - http://www.cyberciti.biz/faq/?p=3402
# Author: nixCraft <www.cyberciti.biz> under GPL v.2.0+
# Páginas de IP's por país: http://www.ipdeny.com/ipblocks/
# -------------------------------------------------------------------------------
ISO="in af ru pl lt vn gb" 

### Set PATH ###
IPT=/sbin/iptables
WGET=/usr/bin/wget
EGREP=/bin/egrep

### No editing below ###
SPAMLIST="countrydrop"
ZONEROOT="/root/iptables"
DLROOT="http://www.ipdeny.com/ipblocks/data/countries"

cleanOldRules(){
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
}

# create a dir
[ ! -d $ZONEROOT ] && /bin/mkdir -p $ZONEROOT

# clean old rules
cleanOldRules

# create a new iptables list
$IPT -N $SPAMLIST

for c  in $ISO
do 
    # local zone file
    tDB=$ZONEROOT/$c.zone

    # get fresh zone file
    $WGET -O $tDB $DLROOT/$c.zone

    # country specific log message
    SPAMDROPMSG="$c Country Drop"

    # get 
    BADIPS=$(egrep -v "^#|^$" $tDB)
    for ipblock in $BADIPS
    do
       $IPT -A $SPAMLIST -s $ipblock -j LOG --log-prefix "$SPAMDROPMSG"
       $IPT -A $SPAMLIST -s $ipblock -j DROP
    done
done

# Drop everything 
$IPT -I INPUT -j $SPAMLIST
$IPT -I OUTPUT -j $SPAMLIST
$IPT -I FORWARD -j $SPAMLIST

# call your other iptable script
# /path/to/other/iptables.sh

exit 0

Regards

Jaime

4

Will "-w" option really work?

Probably: man iptables:

 -w, --wait
      Wait for the xtables lock.  To prevent multiple instances of the program from running concurrently,  an  attempt  will  be  made  to
      obtain  an  exclusive  lock at launch.  By default, the program will exit if the lock cannot be obtained.  This option will make the
      program wait until the exclusive lock can be obtained.) 

Where in the following script can I add it?

To the definition of the iptables command

IPT="/sbin/iptables -w"
3

The option -w just allows the iptables wait for lock until timeout, but it's not the solution of root cause.

Your issue is just a consequence of some other issue. Likely some other script trying to update your iptables ruleset at same time with your script.

You can implement your firewall rule set more elegant and simple way with the ipset. In this case you also will improve the performance because less rules meanse more performance. Only thing you'll loose, is understandable logging, but there is also a workaround.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.