3

I host gameservers on my dedicated server and was setting up the firewall a few days ago (had to set everything up again, hard drive failed and I forgot to back-up).

Everything ran fine, firewall rules worked properly, until I had to reboot the server. I rebooted the server using the standard reboot command, and the server never came back up.

I contacted my provider who looked at it, and observed that the rules in iptables were completely reset, blocking every port on the server.

I had enabled the firewall via sudo ufw enable and had added the relevant in iptables (as seen here):

sudo ufw enable
sudo iptables -A INPUT -d 85.25.95.217/32 -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -d 85.25.95.217/32 -p tcp --dport 443 -j ACCEPT
sudo iptables -A INPUT -d 85.25.95.217/32 -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 443 -j DROP
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 443 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 443 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 80 -j DROP
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 8880 -j DROP
sudo iptables -A INPUT -d 85.25.110.75/32 -p tcp --dport 8881 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 8880 -j DROP
sudo iptables -A INPUT -d 85.25.116.59/32 -p tcp --dport 8881 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 8880 -j DROP
sudo iptables -A INPUT -d 188.138.110.103/32 -p tcp --dport 8881 -j DROP
sudo iptables-save > /etc/network/iptables.rules
reboot

In my interfaces file I have put pre-up iptables-restore < /etc/network/iptables.rules at the end.

What did I do wrong, or if I didn't do anything wrong, why did ufw reset/block all ports when the server was rebooted?

Community
  • 1
AStopher
  • 135

1 Answers1

4

Okay so if you use iptables from the command line you they don't get restored on reload or reboot.

You can ever set your firewall rules with ufw instructions here or if you really need to use iptables you need to save your rules to file and have them restored back before your network comes up, you should also disable ufw as bodhi.zazen suggested so:

sudo ufw disable # You don't want UFW managaing your firewall if you are.
iptables -A INPUT -p tcp --match multiport --dports 1:79 -j ACCEPT
iptables -A INPUT -p tcp --match multiport --dports 81:65535 -j ACCEPT
sudo sh -c "iptables-save > /etc/iptables.rules"

Assuming you have setup your network interfaces by using /etc/network/interfaces

Find your stub for your interface and add the following to the stanza:

pre-up iptables-restore < /etc/iptables.rules

e.g.

auto eth0
iface eth0 inet dhcp
pre-up iptables-restore < /etc/iptables.rules
# post-down iptables-restore < /etc/iptables.downrules # if needed

More detailed instructions and variations here

squareborg
  • 10,737