3

I host gameservers on my dedicated server and was setting up the firewall a few days ago (had to set everything up again, hard drive failed and I forgot to back-up).

Everything ran fine, firewall rules worked properly, until I had to reboot the server. I rebooted the server using the standard reboot command, and the server never came back up.

I contacted my provider who looked at it, and observed that the rules in iptables were completely reset, blocking every port on the server.

I had enabled the firewall via sudo ufw enable and had added the relevant in iptables (as seen here):

sudo ufw enable
sudo iptables -A INPUT -d 85.25.95.217/32 -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -d 85.25.95.217/32 -p tcp --dport 443 -j ACCEPT
sudo iptables -A INPUT -d 85.25.95.217/32 -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 443 -j DROP
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 443 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 443 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 8880 -j DROP
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 8881 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 8880 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 8881 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 8880 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 8881 -j DROP
sudo iptables-save > /etc/network/iptables.rules
reboot

In my interfaces file I have put pre-up iptables-restore < /etc/network/iptables.rules at the end.

What did I do wrong, or if I didn't do anything wrong, why did ufw reset/block all ports when the server was rebooted?

1
  • 1
    You can greatly simplify your work using UFW as the only port you are rejecting is port 80. So you need just a single rule too block port 80 in UFW and accept all the rest.
    – Panther
    Mar 2, 2015 at 12:32

1 Answer 1

4

Okay so if you use iptables from the command line you they don't get restored on reload or reboot.

You can ever set your firewall rules with ufw instructions here or if you really need to use iptables you need to save your rules to file and have them restored back before your network comes up, you should also disable ufw as bodhi.zazen suggested so:

sudo ufw disable # You don't want UFW managaing your firewall if you are.
iptables -A INPUT -p tcp --match multiport --dports 1:79 -j ACCEPT
iptables -A INPUT -p tcp --match multiport --dports 81:65535 -j ACCEPT
sudo sh -c "iptables-save > /etc/iptables.rules"

Assuming you have setup your network interfaces by using /etc/network/interfaces

Find your stub for your interface and add the following to the stanza:

pre-up iptables-restore < /etc/iptables.rules

e.g.

auto eth0
iface eth0 inet dhcp
pre-up iptables-restore < /etc/iptables.rules
# post-down iptables-restore < /etc/iptables.downrules # if needed

More detailed instructions and variations here

9
  • good answer, the Solution #2 /etc/network/if-pre-up.d from the "more detailed instructions" link works for me. basically 1. create your /etc/iptables.rules file as Shutupsquare says 2. make a script /etc/network/if-pre-up.d/iptablesload which runs iptables rules. it will load on reboot. I dont have any need for post-down rules, so I don't bother with that. Mar 2, 2015 at 12:32
  • If you are going to use iptables directly like this you should disable UFW, otherwise the two tools are trying to configure your firewall at the same time.
    – Panther
    Mar 3, 2015 at 0:39
  • @bodhi.zazen You are correct, I neglected to say that. Thanks I have added it in.
    – squareborg
    Mar 3, 2015 at 8:17
  • No longer the accepted answer as this no longer answers the question.
    – AStopher
    Mar 4, 2015 at 8:24
  • 1
    @ʎǝʞuoɯɹǝqʎɔ Yes you turn ufw then you block everything unless you tell it not too (using ufw).
    – squareborg
    Mar 4, 2015 at 12:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .