Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have a server running Ubuntu 12.04.

A couple of reboots back I started noticing that iptables rules get doubled upon reboot.

This is what I get after a reboot (with added line breaks):

$ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N fail2ban-apache-overflows
-N fail2ban-ssh
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache-overflows
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh

-A INPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 1.2.3.4/32 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p udp -m udp --dport 53 -m hashlimit --hashlimit-above 20/sec --hashlimit-burst 100 --hashlimit-mode srcip --hashlimit-name DNS --hashlimit-htable-expire 1 --hashlimit-srcmask 28 -j DROP

-A INPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 1.2.3.4/32 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p udp -m udp --dport 53 -m hashlimit --hashlimit-above 20/sec --hashlimit-burst 100 --hashlimit-mode srcip --hashlimit-name DNS --hashlimit-htable-expire 1 --hashlimit-srcmask 28 -j DROP

-A fail2ban-apache-overflows -j RETURN
-A fail2ban-ssh -j RETURN

The four rules that get applied twice should get loaded from if-pre-up.d:

$ cat /etc/network/if-pre-up.d/iptablesload
#!/bin/bash

# Flush iptables
/sbin/iptables -F

#MySQL locally
/sbin/iptables -A INPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
# Mysql access allowed from work
/sbin/iptables -A INPUT -s 1.2.3.4/32 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -p tcp -m tcp --dport 3306 -j REJECT --reject-with icmp-port-unreachable

# Rate limit on DNS requests
/sbin/iptables -A INPUT -p udp -m udp --dport 53 -m hashlimit --hashlimit-above 20/sec --hashlimit-burst 100 --hashlimit-mode srcip --hashlimit-name DNS --hashlimit-htable-expire 1 --hashlimit-srcmask 28 -j DROP

exit 0

I have tried adding this clean-up script to make sure everything get nuked when the server goes down:

$ cat /etc/network/if-post-down.d/iptablesunload
#!/bin/sh
echo "Stopping firewall and allowing everyone..."
/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -t nat -F
/sbin/iptables -t nat -X
/sbin/iptables -t mangle -F
/sbin/iptables -t mangle -X
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -P OUTPUT ACCEPT

But it makes no difference.

Re-applying everything cleans up the mess:

$ sudo /etc/network/if-post-down.d/iptablesunload; sudo /etc/network/if-pre-up.d/iptablesload; sudo service fail2ban restart; sudo iptables -S
Stopping firewall and allowing everyone...
 * Restarting authentication failure monitor fail2ban                                                                                           [ OK ]
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N fail2ban-apache-overflows
-N fail2ban-ssh
-A INPUT -p tcp -m multiport --dports 80,443 -j fail2ban-apache-overflows
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -s 1.2.3.4/32 -p tcp -m tcp --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p udp -m udp --dport 53 -m hashlimit --hashlimit-above 20/sec --hashlimit-burst 100 --hashlimit-mode srcip --hashlimit-name DNS --hashlimit-htable-expire 1 --hashlimit-srcmask 28 -j DROP
-A fail2ban-apache-overflows -j RETURN
-A fail2ban-ssh -j RETURN

I've added an echo to iptablesload to track when the script runs:

echo "$PPID: `ps -ocommand= -p $PPID`" > /tmp/loading_iptables.`date +%F_%H:%M:%S.%N`

After a reboot I can now verify that the script runs multiple times:

$ ls /tmp/
loading_iptables.2014-06-30_09:58:06.732185289
loading_iptables.2014-06-30_09:58:06.766291579
$ cat /tmp/*
729: run-parts /etc/network/if-pre-up.d
782: run-parts /etc/network/if-pre-up.d

This then brings up two questions:

  1. why does the script run twice?
  2. why doesn't the iptables -F clean up rules between executions?
share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Your rule is probably being run for one network device AND loopback device.

To exclude the loopback device add this to the top of your script just below your shebang, which checks the current device being started is not loopback "lo" :

[ "$IFACE" != "lo" ] || exit 0

Or to ensure rule runs only for a specified device (e.g. eth0):

[ "$IFACE" == "eth0" ] || exit 0
share|improve this answer
    
Brilliant! Making the script run only for eth0 solves it. –  azzid Jun 30 at 8:41
    
My guess is that the script ran both for eth0 and lo in parallell, thus they both flush the tables simultaneously and then they both add the same rules, producing the multiples. –  azzid Jun 30 at 8:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.