2

Totally new to netfilter thing, currently am running an application which uses three interfaces eth0/eth1/eth2, my application will run on two servers and they both can communicate between them via their own interfaces (eth0/eth1/eth2)

In ubuntu 18.04 (kernel version 4.*), I just used iptables commands to break the communication between them.

In 22.04 (kernel version 6.2.*), I use the same iptable commands to break the communication between two servers but things are not working as expected (My app code remains unchanged) -- my application has the mechanism to report whether the neighbor server is reachable or not -- in 22.04 with iptables rules applied, it still reports the other server is reachable (not the case in 18.04).

I could see there's a lot has been changed regard to how Network traffic can be filtered between two kernel versions (more tools in recent one).

I removed the ufw just to avoid conflicts with nftables, one observation is, when I applied the rule, for a brief moment my app reports the neighbor server is unreachable and suddenly it will change to reachable, something is overriding the rule, am unsure.

Now am seeking help here to see what I have missed...

-A INPUT -s x.x.x.x/32 -d y.y.y.y/32 -i eth2 -j DROP
-A INPUT -s x.x.x.y/32 -d y.y.y.x/32 -i eth1 -j DROP
-A INPUT -s x.x.y.y/32 -d y.y.x.x/32 -i eth0 -j DROP

-A OUTPUT -s y.y.y.y/32 -d x.x.x.x/32 -o eth2 -j DROP
-A OUTPUT -s y.y.y.x/32 -d x.x.x.y/32 -o eth1 -j DROP
-A OUTPUT -s y.y.x.x/32 -d x.x.y.y/32 -o eth0 -j DROP

Note: All my rules are prepended in the chain to make sure that are taking precedence over anything else

Chain INPUT (policy DROP)
target     prot opt source               destination
DROP       all  --  xxxx  yyyy
DROP       all  --  zzzz  AAAA
DROP       all  --  BBBB  CCCC
2
  • Need to look at the whole iptables config to make sure there is not a preceding rule that passes the traffic before your rules block it. If this is meant to be temporary, you might want to use -I INPUT 1 instead of -A INPUT to put your rule first.
    – user10489
    Nov 29, 2023 at 14:47
  • Thanks for your response, yes, I made sure that my rules are prepended in the chain @user10489
    – RaGa__M
    Nov 29, 2023 at 15:11

1 Answer 1

0

On Ubuntu 22.04 nftables is used by default.

What’s new in Security for Ubuntu 22.04 LTS?

nftables as the default firewall backend

Firewalling on Linux consists of two components – the firewall mechanism within the Linux kernel, and the tools used to configure this from userspace. The Linux kernel has traditionally supported two different subsystems for firewall policies – iptables / xtables and the newer nftables. nftables brings significant benefits both in terms of performance and flexibility when creating and deploying firewall rules, particularly for dual stack IPv4/IPv6 systems. The traditional iptables userspace management tool now configures the nftables kernel backend, whilst the new nft userspace tool is also present to allow the creation of more flexible rules not supported by the traditional iptables paradigm.

You can translate the iptables rules to nft through iptables-translate and ipt6ables-translate. e,g:

iptables-translate -A INPUT -s x.x.x.x/32 -d y.y.y.y/32 -i eth2 -j DROP

see the manpage for more details

Revert back to iptables.

Use the following command to see and change the priority:

update-alternatives --config iptables 

sample output:

  Selection    Path                       Priority   Status
------------------------------------------------------------
* 0            /usr/sbin/iptables-nft      20        auto mode
  1            /usr/sbin/iptables-legacy   10        manual mode

Set the highest priority to iptables:

sudo update-alternatives --install /usr/bin/iptables iptables /usr/sbin/iptables-nft 30

Set it by default:

sudo update-alternatives  --set iptables /usr/sbin/iptables-legacy

Disable UFW and nft:

sudo systemctl disable --now ufw 
sudo systemctl disable --now nftables
sudo apt install iptables-persistent
sudo systemctl enable --now iptables

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .