1

I have a server and severals VPS's on it, so I use iptables to redirects ports, I am doing it automatically via script.

It is about 500 iptables commands to insert a rules after server restart, but sometimes there is only a few commands excuted and the rest of them fails and the iptables commands return exit value 4, I have not found anywhere what does it mean ?

I am inserting 500 rules inside for-each cycle so basically in the same time I am inserting that many rules, could that be the problem ?

1

From spelunking the source in include/xtables.h we find

enum xtables_exittype {
        OTHER_PROBLEM = 1,
        PARAMETER_PROBLEM,
        VERSION_PROBLEM,
        RESOURCE_PROBLEM,   // number 4 because that's how enum count

With some wild assumptions about the code branch being followed (are there no errors printed by your iptables?), iptables/iptables.c can exit(RESOURCE_PROBLEM) on account of what looks like a locking issue. This fits with your description of a tight loop of iptables commands (though there should be some error to standard error, does yours print that?); perhaps instead use iptables-restore to atomically insert all the changes you need in one go, or slow down the loop (and confirm that this code is the error path being triggered).

  • It is really strange because I am executing the iptables commands from Java with Runtime.getRuntime().exec("iptables cmd").waitFor(); so the method should wait until the command is finished but I will try to add more delay after every command. – Welite May 4 '17 at 20:38
  • @Welite hmm, is iptables being run from anywhere else and thus sabotaging your code? sysdig could record the exec(3)s of iptables: sudo sysdig "proc.name = iptables and (evt.type = execve or evt.type = procexit)" – thrig May 4 '17 at 20:49
  • Nothing found and I am also pretty sure that there is not any external process manipulating with iptables, because the only thing running on the actual host machine is my software managing the creation of OpenVZ VPS's and redirecting ports on them. The problem is that it not always fails, the code works 90% of the time and all rules are inserted correctly but the 10% of times not I am really desparate because I cannot find the actual reason why it fails because no message or anything is returned by the iptables. – Welite May 4 '17 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.