3

I just got a new dedicated server with CentOS and I'm trying to debug some network problems. In doing so, I found over one thousand iptables entries. Is this the default on a CentOS system? Is there some firewall package that might be guilty of doing that?

1

Is this the default on a CentOS system?

No. The default one is below.

Is there some firewall package that might be guilty of doing that?

Probably. You don't say what the entries are but if they're banning CIDR blocks I'd guess your server has a firewall like APF or CSF that can subscribe to blacklist like Spamhaus' DROP and that is how your rules are being generated. Alternatively, there might be some cron job which does it all. If you do a grep -rl iptables /etc/* that will tell you all the files that mention iptables and hopefully track down what is generating your entries.

Here's the default iptables from /etc/sysconfig/iptables:

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
  • Thanks. APF is at least part of the problem. I had over 500 lines mention iptables in 50 files. iptables has been made completely useless by this thing. – Shawn J. Goff Mar 26 '11 at 16:04
  • Okay, I found the original problem; it was indeed APF. APF made iptables completely unusable, but APF itself was configurable via /etc/apf/conf.apf. – Shawn J. Goff Mar 26 '11 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.