iptables default forward policy reverts to ACCEPT after bootup

[ODTech]

Hi all.

I have a smoothly running ubuntu 12.04 firewall/gateway/dhcp-server.

I'm using the iptables-persistent module to reload firewall rules when the system reboot. it works well except it reverts the default for the forward chain back to ACCEPT but i need it to stay on DROP.

I've purged ufw from the system with no change
The rules in /etc/iptables/rules.v4 correctly give the default action for forward as DROP

Below is what my rules.v4 looks like.

# Generated by iptables-save v1.4.12 on Mon Dec 8 11:25:36 2014
*filter
:INPUT DROP [95:6721]
:FORWARD DROP [261:13279]
:OUTPUT ACCEPT [281:19088]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s 192.168.1.0/24 -p tcp -m tcp --dport 18083 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -p tcp -m tcp --dport 5938 -j ACCEPT
-A FORWARD -s 192.168.1.56/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -s 192.168.1.56/32 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -s 192.168.1.59/32 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -s 192.168.1.59/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -s 192.168.1.69/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -s 192.168.1.69/32 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -s 192.168.1.50/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -s 192.168.1.50/32 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -p tcp -m tcp --dport 995 -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -p tcp -m tcp --dport 465 -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -p tcp -m tcp --dport 578 -j ACCEPT
COMMIT
# Completed on Mon Dec 8 11:25:36 2014
# Generated by iptables-save v1.4.12 on Mon Dec 8 11:25:36 2014
*nat
REROUTING ACCEPT [719:82261]
:INPUT ACCEPT [4:584]
:OUTPUT ACCEPT [24:1708]
OSTROUTING ACCEPT [2:160]
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Dec 8 11:25:36 2014

Anyone got an idea why it's reverting to ACCEPT?

 

[sicelo.m]

You sure iptables restores these exact rules? Could it perhaps be that there's another copy of these rules somewhere, and the config reads that instead? What is your exact command that restores your set rules?

Perhaps try (if that's not what you're doing already)

~# iptables-restore < /etc/iptables/rules.v4

If this gives you correct rules, then you can be 100% that 'auto-restore' is restoring something else.

 

[Lupus]

There is an easier way, once you've got the iptables the way you want them, service iptables save. This will save them to where-ever ubuntu stores them.

 

[sicelo.m]

There is an easier way, once you've got the iptables the way you want them, service iptables save. This will save them to where-ever ubuntu stores them.

Notice

# Generated by iptables-save v1.4.12 on Mon Dec 8 11:25:36 2014
*filter
:INPUT DROP [95:6721]
:FORWARD DROP [261:13279]
:OUTPUT ACCEPT [281:19088]
...

 

[Lupus]

Notice

Oh right yeah that doesn't help . I've not played with ubuntu for awhile, but maybe check there isn't something in init.d that's calling the iptables and it's referencing another file.

 

[SauRoNZA]

Why not use UFW instead of all this manual hackery?

 

[Rocket-Boy]

I have never really understood using distro specific stuff. I write a shell script with my firewall rules and then run in on each startup.
I just prefer it that way.

 

[sicelo.m]

the OP 'died'? we're interested to know how the issue is progressing...

 

[Paul_S]

I have never really understood using distro specific stuff. I write a shell script with my firewall rules and then run in on each startup.
I just prefer it that way.

+1
I also prefer to see everything in one config which I control.

 

[ODTech]

You sure iptables restores these exact rules? Could it perhaps be that there's another copy of these rules somewhere, and the config reads that instead? What is your exact command that restores your set rules?

Perhaps try (if that's not what you're doing already)

~# iptables-restore < /etc/iptables/rules.v4

If this gives you correct rules, then you can be 100% that 'auto-restore' is restoring something else.

I checked, if i completely remove the file /etc/iptables/rules.v4 and reboot the server it starts with a "flushed" firewall. When i do sudo iptables-restore < /etc/iptables/rules.v4 manualy the rules are loaded correctly but when i reboot and let the program iptables-persistent load the firewall the default for the FORWARD CHAIN is set to ACCEPT. iptables-persistent also gets the rules from /etc/iptables/rules.v4, it's coded into the config file under /etc/default/iptables-persistent.

So in short yes it looks like the rules set under /etc/iptables/rules.v4 is the only copy being loaded.

There is an easier way, once you've got the iptables the way you want them, service iptables save. This will save them to where-ever ubuntu stores them.

Done by using iptables-persistent.

Why not use UFW instead of all this manual hackery?

UFW can't manage the forward chain besides setting defaults to DROP or ACCEPT. I need the forward chain since the server is a firewall/dhcp/gateway. Certain staff are not allowed to have access to internet, others do..

the OP 'died'? we're interested to know how the issue is progressing...

Still kickin

+1
I also prefer to see everything in one config which I control.

That's the next step, i'll ditch the iptables-persistent program and just try a regular script that loads the rules at startup.

 

[DrJohnZoidberg]

Just try and load the rules file from within your interfaces file rather then.