1

On my first server, I've debian 8.8 and iptables v1.4.21 On my second server, I've debian 9.3 and iptables v1.6.0

I've a script to change my Iptables rules on my first server. My iptable config work well on my first server, allow SSH, drop all, allow ping, HTTP and HTTPS traffic, full input traffic on range 8070:9090 for development purpose, Ip restriction on database port, loopback, and local docker0 interface.

When i'm simply copy/past and run this script, my new server drop all connection except my current SSH and don't protect my server.

Here is the script

iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT ACCEPT

iptables -A INPUT -p tcp -i eth0 --dport ssh -j ACCEPT

iptables -A INPUT -p icmp -j ACCEPT

iptables -t filter -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -p tcp -m multiport --sports 80,443 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -i eth0 -m multiport --dport 80,443 -j ACCEPT

iptables -A INPUT -p tcp -i eth0 --dport 8070:9090 -j ACCEPT


#MONGODB
iptables -A INPUT -p tcp -i eth0 --dport 27017 -s someIp,someIp,someIp -j ACCEPT

iptables -t filter -A OUTPUT -o lo -j ACCEPT
iptables -t filter -A INPUT -i lo -j ACCEPT

iptables -I INPUT -i docker0 -j ACCEPT

What should i update in my script to get the same result on my second server as my first one ?

Thanks

4

If it's a fresh install of Debian 9, the name of the network interface is not necessarily eth0. Debian transitioned to Predictable Network Interface Names by default on new installations.

  • If the NIC is integrated on-board and the firmware/BIOS has the appropriate information, the first NIC will be eno1.
  • If the NIC is in a PCIe hot-plug slot, its name will be ens<slot ID>.
  • If the NIC has a PCI device ID, its name will be constructed from it: PCI device XX:YY.Z will be enpXsY if Z=0, or enpXsYfZ if Z>0. Note that lspci uses hexadecimal numbers, but the network device names are in regular decimal system.
  • otherwise, the old naming scheme is used.

Upgrades from Debian 8 will keep the old naming scheme, and you can switch back to the old scheme if you want.

  • Thanks for this. You just point it right, the old eth0 is ens3. Thank you – vmathieu Jan 16 '18 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.