3

I host gameservers on my dedicated server and was setting up the firewall a few days ago (had to set everything up again, hard drive failed and I forgot to back-up).

Everything ran fine, firewall rules worked properly, until I had to reboot the server. I rebooted the server using the standard reboot command, and the server never came back up.

I contacted my provider who looked at it, and observed that the rules in iptables were completely reset, blocking every port on the server.

I had enabled the firewall via sudo ufw enable and had added the relevant in iptables (as seen here):

sudo ufw enable
sudo iptables -A INPUT -d 85.25.95.217/32 -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -d 85.25.95.217/32 -p tcp --dport 443 -j ACCEPT
sudo iptables -A INPUT -d 85.25.95.217/32 -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 443 -j DROP
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 443 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 443 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 8880 -j DROP
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 8881 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 8880 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 8881 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 8880 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 8881 -j DROP
sudo iptables-save > /etc/network/iptables.rules
reboot

In my interfaces file I have put pre-up iptables-restore < /etc/network/iptables.rules at the end.

What did I do wrong, or if I didn't do anything wrong, why did ufw reset/block all ports when the server was rebooted?

  • 1
    You can greatly simplify your work using UFW as the only port you are rejecting is port 80. So you need just a single rule too block port 80 in UFW and accept all the rest. – Panther Mar 2 '15 at 12:32
4

Okay so if you use iptables from the command line you they don't get restored on reload or reboot.

You can ever set your firewall rules with ufw instructions here or if you really need to use iptables you need to save your rules to file and have them restored back before your network comes up, you should also disable ufw as bodhi.zazen suggested so:

sudo ufw disable # You don't want UFW managaing your firewall if you are.
iptables -A INPUT -p tcp --match multiport --dports 1:79 -j ACCEPT
iptables -A INPUT -p tcp --match multiport --dports 81:65535 -j ACCEPT
sudo sh -c "iptables-save > /etc/iptables.rules"

Assuming you have setup your network interfaces by using /etc/network/interfaces

Find your stub for your interface and add the following to the stanza:

pre-up iptables-restore < /etc/iptables.rules

e.g.

auto eth0
iface eth0 inet dhcp
pre-up iptables-restore < /etc/iptables.rules
# post-down iptables-restore < /etc/iptables.downrules # if needed

More detailed instructions and variations here

  • good answer, the Solution #2 /etc/network/if-pre-up.d from the "more detailed instructions" link works for me. basically 1. create your /etc/iptables.rules file as Shutupsquare says 2. make a script /etc/network/if-pre-up.d/iptablesload which runs iptables rules. it will load on reboot. I dont have any need for post-down rules, so I don't bother with that. – Michael Coleman Mar 2 '15 at 12:32
  • If you are going to use iptables directly like this you should disable UFW, otherwise the two tools are trying to configure your firewall at the same time. – Panther Mar 3 '15 at 0:39
  • @bodhi.zazen You are correct, I neglected to say that. Thanks I have added it in. – 0x7c0 Mar 3 '15 at 8:17
  • No longer the accepted answer as this no longer answers the question. – cybermonkey Mar 4 '15 at 8:24
  • 1
    @ʎǝʞuoɯɹǝqʎɔ Yes you turn ufw then you block everything unless you tell it not too (using ufw). – 0x7c0 Mar 4 '15 at 12:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.