0

I have a problem, I or we are running a script on a vps server and on this particular server netfilter-persistent is also installed. now if we run the script it doesnt work to use the ports, since the application that needs to ping it cant get access.

to be more clear, on the vps the netfilter is pre-installed so after we apply the new rules we also use:

iptables-save >/etc/iptables/rules.v4

ip6tables-save >/etc/iptables/rules.v6

but when the script is done it doesnt open the ports, but from understanding every change you make is instant? after we do a reboot it works but we would like to do it without having to reboot but untill now we didnt find the solution for it, we tried:

netfilter-persistent start, but its right after the saving of the rules, should netfilter-persistent start be working? or is there another command that restarts it without the need to reboot?

the reason we dont wanna reboot is that, well first let me tell you its to run nodes and some people run also other nodes so if we autoreboot it might or will stop peoples other nodes and we dont want that to happen.

but what basically is the problem is that we add firewall rules (ubuntu 16/18) and because of netfilter-persistent it doesnt work, only when we saved afterwards and rebooted.

I also have tried iptables-restore >/etc/iptables/rules.v4 but i have a feeling that is not the right command either

hope someone can give some inside)

thanks NooBie

edit: i see i made a mistake with the restore i see i used > but it should be <, so will test it now)

part of the script that does the firewall rules:

}

configure_firewall(){ msg "Configuring firewall..."

case ${platform} in
"ubuntu16"|"ubuntu18"|"debian9"|"raspbian9")
    submsg1 "Starting firewall..."

    systemctl daemon-reload &>/dev/null
    systemctl enable ufw &>/dev/null
    systemctl start ufw &>/dev/null

    submsg1 "Setting ports/permissions..."

    ufw default allow outgoing &>/dev/null
    ufw default deny incoming &>/dev/null
    ufw allow ssh &>/dev/null
    ufw limit ssh &>/dev/null
    ufw allow 8895 &>/dev/null
    ufw allow 30666 &>/dev/null
    ufw logging on &>/dev/null
    ufw --force enable &>/dev/null
;;
"centos7")
    submsg1 "Starting firewall..."

    systemctl disable ufw &>/dev/null
    systemctl stop ufw &>/dev/null

    systemctl daemon-reload &>/dev/null
    systemctl enable firewalld &>/dev/null
    systemctl start firewalld &>/dev/null

    submsg1 "Setting ports/permissions..."

    default_zone="$(firewall-cmd --get-default-zone)"

    firewall-cmd --zone=${default_zone} --permanent --add-port=8895/tcp &>/dev/null
    firewall-cmd --zone=${default_zone} --permanent --add-port=8895/udp &>/dev/null
    firewall-cmd --zone=${default_zone} --permanent --add-port=30666/tcp &>/dev/null
    firewall-cmd --zone=${default_zone} --permanent --add-port=30666/udp &>/dev/null
    firewall-cmd --zone=${default_zone} --permanent --add-service=ssh &>/dev/null

    firewall-cmd --reload &>/dev/null
;;
esac

if hash iptables-save 2>/dev/null; then
    # save iptables firewall rules
    iptables-save > /etc/iptables/rules.v4
    ip6tables-save > /etc/iptables/rules.v6
fi

if hash netfilter-persistent 2>/dev/null; then
    netfilter-persistent start
fi

}

  • 1
    iptables-restore > /etc/iptables/rules.v4 doesn't make sense. This writes output from iptables-restore to the file. Please edit your post to include firewall rules you have, and exact commands you are running. – vidarlo Dec 31 '18 at 12:23
  • i see i must use: iptables-restore < /etc/iptables/rules.v4 where ">" was wrong – Purely Crypto Dec 31 '18 at 12:43
  • You will have overwritten whatever was in those files by now. I suggest that you describe what you're trying to achieve, and what doesn't work. – vidarlo Dec 31 '18 at 12:45
  • yeah so after we apply the new rules we save them with: iptables-save > /etc/iptables/rules.v4 and the other, and it does save them, so that works, but what doesnt work is that the port work directly, if we reboot the server it does work and iptables shows our new rules, what we want is it to work without having to reboot. dunno how to say it more clearly than this – Purely Crypto Dec 31 '18 at 12:48
  • Iptables reads rules sequentially, and adding rules does not remove prior rules. Have you flushed your rules before trying to save over them? If not, your table just gets longer, but the first set of rules you saved is all that gets read. To flush the rules, run sudo iptables -vF and then re-apply the rules you want. – Minty Dec 31 '18 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.