Iptables Stops Working!

pin_bk · 03-30-2005, 03:04 AM

My iptables suddenly stops working. What should I do?

My iptables rules are are setup like this:

Code:

/usr/sbin/iptables -A FORWARD -p tcp --source-port 4661 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4662 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4663 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4664 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4665 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4666 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4667 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4668 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4669 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4221 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4222 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4223 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 4242 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 6881 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 6882 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 6883 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 6884 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 6885 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 6886 -i eth2 -j DROP
/usr/sbin/iptables -A FORWARD -p tcp --source-port 6887:6890 -i eth2 -j DROP

pin_bk · 03-30-2005, 03:05 AM

# wc -l /proc/net/ip_conntrack
1923 /proc/net/ip_conntrack

# cat /proc/sys/net/ipv4/ip_conntrack_max
8192

pin_bk · 03-30-2005, 04:12 AM

When I restart my network interfaces with rcnetwork restart, and then again load my iptables rules, the firewall works well for some certain time, and again the same thing happens, after some time it stops working.

Code:

# rcnetwork restart
Shutting down network interfaces:
    eth0      device: VIA Technologies, Inc. VT6105 [Rhine-III] (rev 86)
    eth0      configuration: eth-id-00:0f:3d:f8:54:73                                                                                            done
    eth1      device: Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE] (rev 16)
    eth1      configuration: eth-id-00:60:94:0a:10:7a                                                                                            done
    eth2      device: 3Com Corporation 3c905 100BaseTX [Boomerang]
    eth2      configuration: eth-id-00:60:08:5d:dd:8a                                                                                            done
Shutting down service network  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .                                                                       done
Hint: you may set mandatory devices in /etc/sysconfig/network/config
Setting up network interfaces:
    lo
    lo        IP address: 127.0.0.1/8                                                                                                            done
    eth0      device: VIA Technologies, Inc. VT6105 [Rhine-III] (rev 86)
    eth0      configuration: eth-id-00:0f:3d:f8:54:73
    eth0      IP address: 10.40.0.10/24                                                                                                          done
    eth1      device: Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE] (rev 16)
    eth1      configuration: eth-id-00:60:94:0a:10:7a
    eth1      IP address: 10.0.0.138/24                                                                                                          done
    eth2      device: 3Com Corporation 3c905 100BaseTX [Boomerang]
    eth2      configuration: eth-id-00:60:08:5d:dd:8a
    eth2      IP address: 80.65.83.XX/26                                                                                                         done
Setting up service network  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .                                                                       done