Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I installed Ubuntu Server 64-bit 14.04 a week ago. It worked fine for one to several days, then out of the blue, iptables became meaningless (I noticed FTP and such are down ). Only ports 22, 25 & 80 are open. iptables -S looks fine but for some reason is no longer honored. Flush & all ports are not open, just 22, 25 & 80. network-manager is not installed (I verified that too). I don't have any other firewall... I don't get it?

/etc/network/interfaces:

auto lo
iface lo inet loopback

auto em1
iface em1 inet static
        address XX.15.191.XXX
        netmask 255.255.255.240
        gateway XX.15.191.XXX
        dns-nameservers XX.105.28.XX

pre-up iptables-restore < /etc/iptables.rules
post-down iptables-restore > /etc/iptables.downrules

/etc/hosts

127.0.0.1       localhost
127.0.1.1       MY-SERVER.ph.cox.net   MY-SERVER
XX.15.191.XXX   mysite.com

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

/etc/hostname:

MY-SERVER

/etc/resolv.conf ( not set be my, autoset if I understand correct ):

nameserver XX.105.28.XX

/etc/iptables.rules

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [19969:30829963]# <--- not sure where this came from?
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource
-A INPUT -m recent --update --seconds 90 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
#-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4444 -j ACCEPT
-A INPUT -p tcp -d 0/0 -s 0/0 --dport 5900 -j ACCEPT
#-A INPUT -p tcp -m tcp --dport 5900 -j ACCEPT
-A INPUT -p udp -m udp --dport 5900 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9312 -j ACCEPT
-A INPUT -p icmp -m limit --limit 10/sec -j ACCEPT
-A FORWARD -p icmp -m limit --limit 10/sec -j ACCEPT
-A INPUT -j DROP
-A OUTPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
#-A OUTPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 4444 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 5900 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9312 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 20 -j ACCEPT
COMMIT

This is the only noticeable dmesg after boot, but it doesn't seem related as I'm on IP4, and besides, it works for 1 to 3 days.

IPv6: ADDRCONF(NETDEV_UP): em1: link is not ready

dmesg | grep eth0:

[    3.787227] e1000e 0000:00:19.0 eth0: registered PHC clock
[    3.787228] e1000e 0000:00:19.0 eth0: (PCI Express:2.5GT/s:Width x1) c8:60:00:24:ea:cc
[    3.787229] e1000e 0000:00:19.0 eth0: Intel(R) PRO/1000 Network Connection
[    3.787281] e1000e 0000:00:19.0 eth0: MAC: 10, PHY: 11, PBA No: FFFFFF-0FF
[    5.219089] systemd-udevd[157]: renamed network interface eth0 to em1

sudo lsof -i -s tcp:listen ( output as requested )

sshd     960        root    3u  IPv4    564      0t0  TCP *:ssh (LISTEN)
sshd     960        root    4u  IPv6    566      0t0  TCP *:ssh (LISTEN)
mysqld  1011       mysql   12u  IPv4    602      0t0  TCP localhost:mysql (LISTEN)
exim4   2001 Debian-exim    3u  IPv4  11966      0t0  TCP localhost:smtp (LISTEN)
exim4   2001 Debian-exim    4u  IPv6  11967      0t0  TCP localhost:smtp (LISTEN)
exim4   2001 Debian-exim    5u  IPv4  11968      0t0  TCP mysite.com:smtp (LISTEN)
searchd 2025        root    7u  IPv4  14510      0t0  TCP *:9312 (LISTEN)
proftpd 2041     proftpd    2u  IPv6  11974      0t0  TCP *:ftp (LISTEN)
apache2 2103        root    4u  IPv6  11992      0t0  TCP *:http (LISTEN)
apache2 3882    www-data    4u  IPv6  11992      0t0  TCP *:http (LISTEN)
apache2 4230    www-data    4u  IPv6  11992      0t0  TCP *:http (LISTEN)
apache2 etc, etc...

sudo lsof -i -s tcp:listen ( 1 week after ftp worked fine, port is suddenly blocked )

sshd     960        root    3u  IPv4    564      0t0  TCP *:ssh (LISTEN)
sshd     960        root    4u  IPv6    566      0t0  TCP *:ssh (LISTEN)
mysqld  1011       mysql   12u  IPv4    602      0t0  TCP localhost:mysql (LISTEN)
exim4   2001 Debian-exim    3u  IPv4  11966      0t0  TCP localhost:smtp (LISTEN)
exim4   2001 Debian-exim    4u  IPv6  11967      0t0  TCP localhost:smtp (LISTEN)
exim4   2001 Debian-exim    5u  IPv4  11968      0t0  TCP mysite.com:smtp (LISTEN)
searchd 2025        root    7u  IPv4  14510      0t0  TCP *:9312 (LISTEN)
apache2 2103        root    4u  IPv6  11992      0t0  TCP *:http (LISTEN)
apache2 4151    www-data    4u  IPv6  11992      0t0  TCP *:http (LISTEN)
apache2 4710    www-data    4u  IPv6  11992      0t0  TCP *:http (LISTEN)
apache2 etc, etc...

sudo nmap -O mysite.com ( 1 week after ftp worked fine, port is suddenly blocked )

20/tcp   closed ftp-data
21/tcp   closed ftp
22/tcp   open   ssh
25/tcp   open   smtp
53/tcp   closed domain
80/tcp   open   http
143/tcp  closed imap
443/tcp  closed https
993/tcp  closed imaps
3306/tcp closed mysql
4444/tcp closed krb524
5900/tcp closed vnc

sudo iptables-save ( output as requested )

# Generated by iptables-save v1.4.21 on Tue May 27 20:39:05 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [17351423:29122270850]
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource
-A INPUT -m recent --update --seconds 90 --hitcount 4 --rttl --name SSH --mask 255.255.255.255 --rsource -j DROP
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4444 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5900 -j ACCEPT
-A INPUT -p udp -m udp --dport 5900 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9312 -j ACCEPT
-A INPUT -p icmp -m limit --limit 10/sec -j ACCEPT
-A INPUT -j DROP
-A FORWARD -p icmp -m limit --limit 10/sec -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 4444 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 5900 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9312 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 20 -j ACCEPT
COMMIT
# Completed on Tue May 27 20:39:05 2014

ifconfig ( output as requested )

em1       Link encap:Ethernet  HWaddr c8:60:00:24:ea:cc  
          inet addr:XX.15.191.XXX  Bcast:XX.15.191.XXX  Mask:255.255.255.240
          inet6 addr: fe80::ca60:ff:fe24:eacc/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:19212799 errors:0 dropped:0 overruns:0 frame:0
          TX packets:24791186 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6488896548 (6.4 GB)  TX bytes:29719279878 (29.7 GB)
          Interrupt:20 Memory:f7d00000-f7d20000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:4415657 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4415657 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:573695629 (573.6 MB)  TX bytes:573695629 (573.6 MB)
share|improve this question

migrated from serverfault.com May 20 at 6:14

This question came from our site for system and network administrators.

    
"became meaningless"? What do you mean? Can you please post the output of sudo iptables-save?! And while at it, could you please provide the list of interfaces ifconfig (or ip a) shows you?! Oh, and the output of sudo lsof -i -s tcp:listen. –  0xC0000022L May 27 at 23:15
    
Meaningless as iptables stops working. Only select ports such as 22, 25 & 80 are open. How does it go days then all the sudden the other ports such as 20, 21, etc are closed? If I flush the tables it's still 22, 25 & 80. Shouldn't everything be open if flushed? I added the requested 3 items to the original post. thx –  TrailDEX May 28 at 3:46
    
thanks. You can improve readability and speed with the multiport module and/or ipset. However, there is nothing to suggest why they are not enforced. Any internal routing magic, you do? Btw: -m conntrack --ctstate RELATED,ESTABLISHED can become -m state --state RELATED,ESTABLISHED because you make no use of connection tracking. Also, effectively, since the policy of OUTPUT is ACCEPT, you need no rules in that chain, unless you want some extra logging or whatnot. –  0xC0000022L May 28 at 12:35

1 Answer 1

up vote 1 down vote accepted

Okay, I guess we can't figure this out in one go. So I'll edit my answer as we go. The data so far indicates no reason why iptables would not work. Looking at the (potentially) relevant lines of the lsof output I asked you for and you provided, you should only see the ports you mentioned:

Only select ports such as 22, 25 & 80 are open

open and others closed. However, you should see open 21, 22, 80 and 9312. There are no services listening on the other ports (trimmed down version of the sudo lsof -i -s tcp:listen output):

sshd     960        root    3u  IPv4    564      0t0  TCP *:ssh (LISTEN)
sshd     960        root    4u  IPv6    566      0t0  TCP *:ssh (LISTEN)
exim4   2001 Debian-exim    5u  IPv4  11968      0t0  TCP mysite.com:smtp (LISTEN)
searchd 2025        root    7u  IPv4  14510      0t0  TCP *:9312 (LISTEN)
proftpd 2041     proftpd    2u  IPv6  11974      0t0  TCP *:ftp (LISTEN)
apache2 2103        root    4u  IPv6  11992      0t0  TCP *:http (LISTEN)
apache2 ????    www-data    4u  IPv6  11992      0t0  TCP *:http (LISTEN)

Alright, having that established (i.e. they are open, but nothing is listening). We should look into how you are trying to determine whether the port is open or not. The normal way is to do an nmap run from the outside world. Nmap will also be able to distinguish - depending on the circumstances - between open and filtered and closed.

One thing that came to mind is that if you use tcpwrappers, /etc/hosts.deny and /etc/hosts.allow will also play a role without iptables interfering.


Simplification possible

Furthermore your rules can be simplified.

Replace:

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

by:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

unless you intend to make use of connection tracking down the road.

All OUTPUT (filter) rules can be removed, since they don't do anything as long as the policy of that chain is set to ACCEPT.

You probably want to add a rule for DNS on UDP, as UDP is the default. It would look like this:

-A INPUT -p udp -m udp --dport 53 -j ACCEPT

Now all the port names can be put into a more readable form by using the names from /etc/services and thus

-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4444 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5900 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9312 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT # <-- added this one
-A INPUT -p udp -m udp --dport 5900 -j ACCEPT

can be condensed down to the more readable two-liner:

-A INPUT -p tcp -m multiport --dports ftp-data,ftp,ssh,smtp,domain,www,imap2,https,imaps,mysql,4444,5900,9312
-A INPUT -p udp -m multiport --dports domain,5900

with help of the multiport module

All of the rules in a format suitable for iptables-restore then become:

*filter
:INPUT ACCEPT
:FORWARD ACCEPT
:OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
-A INPUT -m recent --update --seconds 90 --hitcount 4 --rttl --name SSH -j DROP
-A INPUT -p tcp -m multiport --dports ftp-data,ftp,ssh,smtp,domain,www,imap2,https,imaps,mysql,4444,5900,9312
-A INPUT -p udp -m multiport --dports domain,5900
-A INPUT -p icmp -m limit --limit 10/sec -j ACCEPT
-A INPUT -j DROP
-A FORWARD -p icmp -m limit --limit 10/sec -j ACCEPT
COMMIT

Piping those rules into an invocation of iptables-restore --test will show you any syntax errors, by the way. This is generally very useful for all cases where you type your rules into a format suitable for iptables-restore or iptables-apply.

Bonus: Variations

You can use ipset(8) (apt-get install ipset) to maintain the port list as well. This can also be used for other things such as locking out whole geographical areas if you have a set of (CIDR) net specifications for those areas. See this.

Of course you can also match against IP sets as source or destination address and address/port combinations. For more information turn to the manual (man ipset) and check out the set module and the SET target (way down from the one before) descriptions in man iptables-extensions.

Last but not least: if you have IPv6 connectivity, you might want to add prefix -6 and -4 respectively before lines on which protocol specific rules are given. This way you can use a single file to store your rules for both ip6tables-restore and iptables-restore. Rules shared between both should not carry the prefix.

For example the condensed rules at the time of this writing could be used for both IPv4 and IPv6. Usually only addresses, net masks and such stuff will require that you split the rules between IPv4 and IPv6. Also: IP sets can only be either IPv4 (default) or IPv6 (ipset create foo family inet6), which means that such sets, due to the different names, will require split rules as well.


You also asked implicitly:

:OUTPUT ACCEPT [19969:30829963]# <--- not sure where this came from?

the numbers between the brackets are the counters for the chain. When using iptables-restore (or its IPv6 counterpart) these are optional. Before the colon is the number of packets, after it the number of bytes. If you run iptables-save with the -c switch you will get the corresponding counters per rule.

share|improve this answer
    
Wow very helpful, thank you! As time permits I'll read up on ipset and simplify my rules too. Networking is obviously something I need to understand better. After a decade I still have VNC in there on a headless server...lol "Not enforced" is a better way to explain than "meaningless". When FTP goes down I'd been checking with an outside "port tester" website. Looks like I need to get more familiar with Nmap. The lsof was current. Next time I notice it stops enforcing I'll report back what lsof and Nmap -O mysite.com says. thx! –  TrailDEX May 28 at 17:03
1  
@TrailDEX: that makes sense. This way we can try to see what's the cause. From what you've shown there is no reason why it wouldn't be enforced, as you put it. But a conceivable cause could be something that causes proftpd to crash, for example. –  0xC0000022L May 28 at 18:58
    
After working for a week this issue surfaced again. FTP is blocked. I added lsof output in the original post. Only difference being the FTP line is now missing. Nmap shows ftp & ftp-data as close now. I can still use FTP through SSH 22 but would really like to figure out the issue and get it right. –  TrailDEX Jun 3 at 17:47
1  
@TrailDEX: congrats. We established now that the FTP service you're using decided to no longer listen. I can not say what caused it (crash or other setting ...), but the point is that it doesn't listen anymore because something is wrong. Read your log files. My guess is that you have log rotation at a 1 week interval and something gets screwed up during log rotation. But the information you gave so far is too little to conclude this. It's just a hint and anyway beyond the topic of your initial question. I suggest to open another question once you picked out the log line. –  0xC0000022L Jun 3 at 17:50
    
appears you nailed it, thx! stackoverflow.com/questions/23666697/… –  TrailDEX Jun 4 at 2:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.