Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've had an init script for many years that configures iptables for me and it has worked like a champ until now. After upgrading from 10.04 to 12.04 I started having firewall problems where the rulesets were being corrupted. After some playing around I discovered that something is setting the following rules:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:53
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:53
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:67
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:67

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            192.168.122.0/24     state RELATED,ESTABLISHED
ACCEPT     all  --  192.168.122.0/24     0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

even when I've completely disabled my own firewall script. My first thought was ufw was somehow active - but it isn't:

# ufw status
Status: inactive

It may or may not be related, but I've only seen this problem on machines I am running kvm on.

Does anyone have pointers to what could be doing this and how to disable whatever is adding these unwanted rules?

Edit for people looking for this in the future: I finally located a source that definitively links these mystery iptables rules to libvirt: http://libvirt.org/firewall.html

share|improve this question
add comment

3 Answers

Is it a multi-homed machine? What's on the 192.168.122.0/24 CIDR? Is there an interface listening on one of the IPs from within that range? I'd probably try to look at the output of:

grep -R 192.168.122 /etc

to find out if there's any configuration related to it and also check cron entries in /etc/cron*

share|improve this answer
    
The 192.168.122 is coming off of virbr0 (created by KVM). What is causing me the most headache is the changes to the default rules. My firewall uses default DROP. The changes use default ACCEPT. I usually end up with a garbage ruleset where the default rules are mine, but the specific rules are the above. Resulting in the firewall blocking almost everything. –  Benjamin Franz Dec 9 '12 at 17:05
add comment

The address space 192.168.122 is commonly used by kvm. You can see more about this in libvirt site.

libvirt

There has all the info.

share|improve this answer
1  
Welcome to Ask Ubuntu! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Braiam Sep 18 '13 at 22:03
add comment

May be ufw is enabled at boot, sets the rules and then gets inactive. May be the rules are hard-coded into ethernet init script. Or KVM's? Why care? Just make iptables command unrunnable from root with chmod and enable it only in your script.

share|improve this answer
    
That is not a good proposed solution. It would just mask the symptom by breaking system functionality rather than fixing the underlying problem. It is like proposing to 'fix' a broken turn signal on a car that won't turn off by pulling the fuse. –  Benjamin Franz Jun 29 '13 at 12:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.