M
M
Misty Hedgehog2015-02-27 16:33:00
linux
Misty Hedgehog, 2015-02-27 16:33:00

Strange behavior of iptables - what could be the reason?

Introductory: there is a system, on board CentOS 7, it worked for a little over a month without complaints (did not reboot yet). At one point - VDS rebooted and .. became invisible from the outside. Having launched VNC, I look - the system is more than alive, it started up, but there is little sense from it.
The first one was hit fail2ban, because. there were already complaints about him, I thought - his paws were the matter. Demolished, restarted again - to no avail. After that, restarted again, and restarted iptables:
ad34c7eba12549038ea505656aa7eeb3
We look journalctl -xn:
9897539a49a24c39a6989ded23481e5f
But at the same time, the server starts responding to requests from the outside! Well, at least something. At the same time, the table is pristine:
6a43daec69b84e25ae3ac4bede10d5f3
After that, we again try to restart in the same way iptables- and we succeed:
42d3d22cc0824561938d069702ac70d0
ec3550ce2a054dcbb7ef198ab84a3922
And what's more - the rules in the table are initialized and start working /etc/sysconfig/iptables:

# Generated by iptables-save v1.4.21 on Fri Feb 27 10:26:11 2015
*filter
:INPUT ACCEPT [187:43206]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [177:82196]
-A INPUT -i eth0 -p tcp -m tcp --dport 22122 -m state --state NEW -m recent --set --name DEFAULT --mask 255.255.255.255
--rsource
-A INPUT -i eth0 -p tcp -m tcp --dport 22122 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name DE
FAULT --mask 255.255.255.255 --rsource -j DROP
-A INPUT -s 82.209.194.0/24 -j DROP
-A INPUT -s 178.54.128.0/17 -j DROP
-A INPUT -s 91.211.140.0/22 -j DROP
-A INPUT -i eth0 -p tcp -m tcp --dport 8080 -j DROP
COMMIT
# Completed on Fri Feb 27 10:26:11 2015

As well as:
$ cat /proc/version
Linux version 3.10.0-123.20.1.el7.x86_64 ([email protected]) (gcc version 4.8.2 20140120 (Red Hat 4.8.2-16) (GCC) ) #1 SMP Thu Jan 29 18:05:33 UTC 2015

Attention - question(s):
1. How?!
2. Why?!
3. How to deal with it?!

Answer the question

In order to leave comments, you need to log in

1 answer(s)
M
Misty Hedgehog, 2015-02-27
@paramtamtam

It was in the included firewalld, simple chkconfig firewalld off && rebootturned out to be enough. Thanks ldvldv for the reply!

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question