LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 02-17-2013, 03:49 PM   #1
JoseCuervo
Member
 
Registered: May 2007
Location: North Carolina
Distribution: Debian 8+, RHEL 7, Fedora22, CentOS7, Ubuntu 14.04
Posts: 74

Rep: Reputation: 18
Home file and minecraft server


Hello everyone,

I've been using linux in VMs for a few years, but I'd like to set up a 24/hr box to run in a corner. As I've been planning this, I keep expanding what I want it to do, which is how I usually run into trouble. My searches have all involved problems more advanced than mine, so I'm sorry that I'm starting from scratch.

My goals are:
home file server to stream movies and music to Windows boxes, laptops, xboxs, etc.
power efficient distro,
secure distro,
minecraft server accessible from the internet as well if possible (only 1-5 people at a time, and rarely).

What I know:
I'll be using a decent 65W Sandybridge Pentium chip (G860),
8Gb of DDR3,
and booting off a smallish performance SSD (30 GB Intel 525 series).
I'll be attaching a 2TB disk for the data, and will be creating a RamDISK for minecraft.

What I don't know:
I've been reading the forum results for minecraft and home servers and have learned a lot already, but I have a few specific, and probably ignorant, questions.
1: Is any distro going to make much of a difference in terms of energy use? Electricity here is almost $.2/kW/hr which is why I'm using a low power CPU and SSD, and letting the 2TB sleep when not in use.
2: With sufficient effort and research on my part, any distro is equally safe and secure, correct?
3: I hate to ask an opinion questions, but I am. Should I aim for a well documented distro like UbuntuServer, that is easily used for file sharing, and adapt it for minecraft as well, OR should I use a minecraft distro and adapt it for file sharing, OR should I use XYZ instead and learn a little bit more along the way? I have heard many people mentioning Debian, which I have played with very briefly, and CentOS, that I have not.
4: What don't I know? Besides what I asked, what do I need to do to have an always on, but power efficient server in the corner? I want it to update automatically, with a minimum of intervention. Tell me whatever you think I might not know, or have overlooked please.

Thanks in advance guys, you've always helped me with stupid projects before. Special thanks to whoever introduced me to Gparted years ago
 
Old 02-17-2013, 08:15 PM   #2
sag47
Senior Member
 
Registered: Sep 2009
Location: Orange County, CA
Distribution: Kubuntu x64, Raspbian, CentOS
Posts: 1,832
Blog Entries: 36

Rep: Reputation: 451Reputation: 451Reputation: 451Reputation: 451Reputation: 451
Quote:
Originally Posted by JoseCuervo View Post
1: Is any distro going to make much of a difference in terms of energy use? Electricity here is almost $.2/kW/hr which is why I'm using a low power CPU and SSD, and letting the 2TB sleep when not in use.
Do you plan on keeping the server on 24x7? If you do there's not much you can do in the way of power saving besides spinning down your disk using hdparm. You're doing the right thing with a low voltage CPU and SSD for power savings. However, your system will always be drawing a minimal amount of power while it's on if that's the case. Most power saver distros do things like put the computer to sleep or in hibernate mode. Which isn't always desirable for an always online system.

Quote:
Originally Posted by JoseCuervo View Post
2: With sufficient effort and research on my part, any distro is equally safe and secure, correct?
This is a big "depends". When you say secure, do you mean on the network? Not all configurations are created equal. At the very least you should implement a firewall and decide what rules you're going to allow. Here's a decent basic iptables firewall for a CentOS/Fedora/RedHat server that could be implemented. I run iptables on my Ubuntu 12.04 machine at work in a similar fashion.

Code:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
#:OUTPUT DROP [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

########################################################################
# PRIVATE HOME NETWORK RULES (192.168.10.x)

#icmp
-A INPUT -p icmp -s 192.168.10.0/24 -j ACCEPT
#dns (if you plan on using as a DNS server then uncomment following two rules)
#-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m tcp --dport 53 -j ACCEPT
#-A INPUT -p udp -s 192.168.10.0/24 -m state --state NEW -m udp --dport 53 -j ACCEPT
#dhcp (if you plan on using as a DHCP server then uncomment following two rules)
#-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m multiport --dports 67,68 -j ACCEPT
#-A INPUT -p udp -s 192.168.10.0/24 -m state --state NEW -m multiport --dports 67,68 -j ACCEPT
############### FILE SHARING RULES
#netbios
-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m tcp --dport 139 -j ACCEPT
#Samba Share
-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m tcp --dport 445 -j ACCEPT
############### END FILE SHARING RULES
#ssh
-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m tcp --dport 22 -j ACCEPT

# END PRIVATE HOME NETWORK RULES (192.168.10.x)
########################################################################

########################################################################
# PUBLIC INTERNET RULES

#minecraft server rule (http://www.minecraftwiki.net/wiki/Tutorials/Setting_up_a_server#Port_forwarding)
-A INPUT -p tcp -m state --state NEW -m tcp --dport 25565 -j ACCEPT

# END PUBLIC INTERNET RULES
########################################################################


#any rules not matching INPUT/FORWARD conditions will be dropped using the following rules.
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
COMMIT
Note: In networking 192.168.10.0/24 is the same thing as an IP address range 192.168.10.1-192.168.10.254 with a 255.255.255.0 subnet mask.

Quote:
Originally Posted by JoseCuervo View Post
3: I hate to ask an opinion questions, but I am. Should I aim for a well documented distro like UbuntuServer, that is easily used for file sharing, and adapt it for minecraft as well, OR should I use a minecraft distro and adapt it for file sharing, OR should I use XYZ instead and learn a little bit more along the way? I have heard many people mentioning Debian, which I have played with very briefly, and CentOS, that I have not.
I would go for a well documented distro. Using Ubuntu Server wouldn't be bad. I'm more inclined to use CentOS/Fedora but that's just me. You should analyze a few things when choosing a distro.
  • How long do you want to support it? Do you want to stick it in a closet for 10 years or are you willing to reinstall every other year? If you prefer your system to stay in the closet forever then use a long term release distro. CentOS has a 7 year support cycle and UbuntuServer LTS has a 5 year support cycle.
  • Do you want to run the system headless (without a GUI) or are you planning on utilizing a GUI? This is important in my opinion because the package management tools in CentOS/Fedora are better than Ubuntu's without a GUI. But with a GUI I like using Synaptic in Ubuntu the best.
  • What kind of kernel support do you need? This past summer I built a relatively recent machine but it had hardware the Linux 2.6 kernel didn't support. I had to use a distro with a Linux 3.x kernel so that ruled out CentOS for me. I'm using Fedora instead. You'd find this out when you try to boot from a live CD.

Quote:
Originally Posted by JoseCuervo View Post
4: What don't I know? Besides what I asked, what do I need to do to have an always on, but power efficient server in the corner? I want it to update automatically, with a minimum of intervention. Tell me whatever you think I might not know, or have overlooked please.
This comes down to power efficient hardware and power efficient software settings. Google around for ACPI settings in the Linux distro of your choice and maybe even compile your own kernel with good ACPI settings. Running the system headless will likely be more power efficient than having a GUI because there will be fewer processes vying for processor time and less work for the graphics chipset. Even if you install a distro with a GUI you can turn the GUI off by switching the run levels on default start up. This can be controlled with /etc/inittab on some distros or another way using systemd.
Code:
# systemd uses 'targets' instead of runlevels. By default, there are two main targets:
#
# multi-user.target: analogous to runlevel 3
# graphical.target: analogous to runlevel 5
#
# To set a default target, run:
#
# ln -s /lib/systemd/system/<target name>.target /etc/systemd/system/default.target
#
runlevel 3 is what I would recommend as it's the multiuser headless "mode" (runlevel 5 is usually used for the graphical environment).

Other things to consider
  • You should check out hdparm for setting your hard drive sleep settings.
  • You should also check out using smartmontools/smartmond for detecting hard drive failures by analyzing your HDD S.M.A.R.T. reporting.
  • You should think about monitoring your system with email alerts. Security is a living thing and setting up a "secure system" is actively maintaining the security.
  • You should think about a recovery plan. What if your 2TB drive fails with all of your data? Would you care? If so then read more in this thread.
Interested to learn more about monitoring for security and getting alerts?
  • Check out Icinga for monitoring and receiving alerts.
  • PNP4Nagios will hook into Icinga and show you a performance trend of your system over time.
  • Configure sendmail to use gmail as a relay (assuming you have a gmail account). And then modify /etc/aliases so that all email is forwarded to your address. Be smart and take advantage of gmail filters by filtering them into a label. This way your inbox isn't overly spammed and you can delete the whole queue when you want.
  • Use your phone service email to receive text message alerts on really important happenings on your system (such as a drive failing which you'd want to know right away). To do this with Icinga check out escalations in the docs.
  • You could install syslog-ng to aggregate your logs and send you a daily digest email of your logs. You could take that a step farther and implement filtering so that you don't get "normal" logs emailed to you and you only receive "unusual logs". Depending on the system you're using it is either using syslog (config file /etc/syslog.conf) or rsyslog (config file /etc/rsyslog.conf). See the man pages for the logging systems "man syslog.conf" or "man rsyslog.conf".

It depends on how much you want to do and how complicated you want to get. I have all of those implemented on my file sharing server and more. It's more of a one stop shop of everything hackery for me. Granted a lot of the software I mentioned for you at the end is designed for handling hundreds and thousands of systems simultaneously but they work well for one system. I use them for my system at home.

SAM

Last edited by sag47; 02-17-2013 at 08:49 PM.
 
Old 02-17-2013, 08:53 PM   #3
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.8, Centos 5.10
Posts: 17,241

Rep: Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325Reputation: 2325
Re Support Lives for RHEL/Centos
Quote:
Red Hat Enterprise Linux 5 and 6 are offered with 10 years of Production Phase support, followed by a three year Extended Life Phase.
https://access.redhat.com/support/po...pdates/errata/

Note that Centos only keeps up with the latest version eg 6.3 is currently available, but 6.2 is now 'vaulted'.
 
Old 02-17-2013, 08:55 PM   #4
JoseCuervo
Member
 
Registered: May 2007
Location: North Carolina
Distribution: Debian 8+, RHEL 7, Fedora22, CentOS7, Ubuntu 14.04
Posts: 74

Original Poster
Rep: Reputation: 18
Sam, that was great, thanks a bunch. I will be setting up Ubuntu Server in a VM and playing with some of the tools and software you mentioned, and moving it to the hardware when I have it. I totally agree about security being a process, not a destination, but I'm only knowledgeable with Windows security. I was thinking about going headless just for the energy savings, but I think I'm already cutting out a few weeks or months of work for myself. So, I'll stick with a gui for now. I appreciate all the help, and I'll be tweaking my VM and asking questions as I go.

Thanks again!
 
Old 02-21-2013, 02:34 AM   #5
JoseCuervo
Member
 
Registered: May 2007
Location: North Carolina
Distribution: Debian 8+, RHEL 7, Fedora22, CentOS7, Ubuntu 14.04
Posts: 74

Original Poster
Rep: Reputation: 18
I've looked into CentOS, and RHEL by default, Debian, and Ubuntu server now. The last few days have had me googling the crap out of the internet. Thanks again for all of the leads so far, I'm having a blast giving myself a shock course in Linux! I've settled on Ubuntu Server as my home file system, at least for now. I'll be using a gui at first, even if I mostly use a terminal for editing settings, and I like the safety net of being able to point and click instead of staring at a cursor waiting for my input. I've installed a samba server on an Ubuntu VM, and started learning about iptables thanks to what you posted.

I want to set up this server to do two things: 1 - serve music, picture and video files to my home network (specifically my subnet? still learning the terms and going to community college at night) and deny all other connections from my network except eventually an SSH or equivalent from one 'whitelisted' mac/IP address (mine) & 2 - allow connections from the internet to play minecraft and do nothing else. So, I want to stop anyone not on the network from trying to administer the server or accessing files, and I want to stop anyone not physically using my computer from doing so as well. IPtables seems like a start for broadly separating the two groups, on the network vs from the internet, but how do I include a MAC address filter? I'm sorry if I'm asking things poorly, I'm only used to Windows terminology, and not well either.

Oh, lastly, should I move this to the Server Forum? I've checked there, and they seem loads more advance than I am, but I don't want to clog the Newbie forum either.
 
Old 02-21-2013, 03:14 AM   #6
sag47
Senior Member
 
Registered: Sep 2009
Location: Orange County, CA
Distribution: Kubuntu x64, Raspbian, CentOS
Posts: 1,832
Blog Entries: 36

Rep: Reputation: 451Reputation: 451Reputation: 451Reputation: 451Reputation: 451
Quote:
Originally Posted by JoseCuervo View Post
I've looked into CentOS, and RHEL by default, Debian, and Ubuntu server now. The last few days have had me googling the crap out of the internet. Thanks again for all of the leads so far, I'm having a blast giving myself a shock course in Linux! I've settled on Ubuntu Server as my home file system, at least for now. I'll be using a gui at first, even if I mostly use a terminal for editing settings, and I like the safety net of being able to point and click instead of staring at a cursor waiting for my input. I've installed a samba server on an Ubuntu VM, and started learning about iptables thanks to what you posted.
Ubuntu Server is good. You can always make the server headless by modifying /etc/inittab (see my original post). If you want to learn a terminal editor then I suggest checking out vim.

Quote:
Originally Posted by JoseCuervo View Post
I want to set up this server to do two things: 1 - serve music, picture and video files to my home network (specifically my subnet? still learning the terms and going to community college at night) and deny all other connections from my network except eventually an SSH or equivalent from one 'whitelisted' mac/IP address (mine)
Knowing how your network is configured would be useful in determining how you should tackle the problem. The iptables rules I originally gave you restrict all services to your local network with exception for the minecraft server.

I assume your network is set up like so...

filesharing Linux server -> <home network 192.168.10.x> -> wireless router -> ISP modem/cable

That being the case there isn't necessarily a need for my 192.168.10.0/24 restrictions since your system is protected behind the NAT of your router. However it is protected against the router port forwarding services that you don't want to be public.

As far as accessing a service such as SSH over a single port just change the -s (source) value to an IP address instead of a range.
Code:
-A INPUT -p tcp -s 192.168.10.25 -m state --state NEW -m tcp --dport 22 -j ACCEPT
Quote:
Originally Posted by JoseCuervo View Post
& 2 - allow connections from the internet to play minecraft and do nothing else. So, I want to stop anyone not on the network from trying to administer the server or accessing files, and I want to stop anyone not physically using my computer from doing so as well.
In that configuration you would need to port forward your minecraft server in order for it to be publicly accessible. In the iptables rules from my original post I link you to an article setting up minecraft with port forwarding on your router.

Quote:
Originally Posted by JoseCuervo View Post
IPtables seems like a start for broadly separating the two groups, on the network vs from the internet, but how do I include a MAC address filter? I'm sorry if I'm asking things poorly, I'm only used to Windows terminology, and not well either.
You ask questions adequately. MAC address filter for what? Filtering by IP should be sufficient if you're utilizing a static IP for the client. MACs can be spoofed and is a false sense of security (easily circumvented). If you still want to know googling iptables mac filter will give you the answer.

Also, read the man page for iptables (terminal).
Code:
man iptables
Quote:
Originally Posted by JoseCuervo View Post
Oh, lastly, should I move this to the Server Forum? I've checked there, and they seem loads more advance than I am, but I don't want to clog the Newbie forum either.
Moving to the server forum may get you better exposure to other sysadmins who can help you better than the newbies area. If you decide you want it moved just click on the 'Report' button on your original post and ask a moderator to move your thread to said desired forum.

SAM

Last edited by sag47; 02-21-2013 at 03:16 AM.
 
Old 02-24-2013, 12:03 AM   #7
JoseCuervo
Member
 
Registered: May 2007
Location: North Carolina
Distribution: Debian 8+, RHEL 7, Fedora22, CentOS7, Ubuntu 14.04
Posts: 74

Original Poster
Rep: Reputation: 18
How can I automatically update the server/

A quick update: I've learned a ton about iptables and I've installed and configured ufw. I'm not completely comfortable with ufw yet, and trying to parse that many rules in order to understand the outcome has taken a while. I've installed and configured the samba service on ubuntu, accessed it from a windows machine, and messed with the permissions. I've tested it by writing to the Ubuntu Server from Win7, and then editing that file back in Ubuntu. Success! I still have to tweak ufw to work with Samba, but you've already given me everything I need to do that myself.

A few questions, as usual. I'll try to be succinct and make my thoughts discrete and not a long narrative.

1: How can I automatically make Ubuntu run apt-get update and apt-get install routinely? Some sort of script that starts with Ubuntu?

2: Are those even the best commands to keep my entire system up to date in one fell swoop?

3: How do I then restart the computer, say at 4:30AM every Wednesday? (or is that even necessary? I'm seeing that the linux kernel is abstracted from services and thus immune to the Windowsesque decay that running processes cause) I do NOT want to update the kernel, just whatever services I have installed.
 
Old 02-24-2013, 12:58 AM   #8
JoseCuervo
Member
 
Registered: May 2007
Location: North Carolina
Distribution: Debian 8+, RHEL 7, Fedora22, CentOS7, Ubuntu 14.04
Posts: 74

Original Poster
Rep: Reputation: 18
One more thing

Thanks so much for the iptables starter you gave me, the specific examples and commenting was what made the difference between reading a man page and understanding the usage. The Samba line was the aha moment for me, and the rest has been much easier. I'm really liking how modular linux is.
 
Old 02-24-2013, 03:34 AM   #9
JoseCuervo
Member
 
Registered: May 2007
Location: North Carolina
Distribution: Debian 8+, RHEL 7, Fedora22, CentOS7, Ubuntu 14.04
Posts: 74

Original Poster
Rep: Reputation: 18
Iptables

So, I didn't even realize that you had %100 tailored those iptable rules to what I had described to you. I started writing my own iptables rules from scratch, and kept referencing yours, and then I started to see the patterns Thanks a million for the effort that went into that.

The helpful article you had linked me to on minecraft port forwarding is one that I had read back when I was running my server on my windows box. Now that I'm making an ubuntu box though, the forwarding I set up on my modem and router will apply just as well. My windows machine has an overclocked 2500k, whereas the Ubuntu server is only going to get a Pentium G860, when and if I get a tax return, which is part of the electricity saving process. As I understand the code you gave me:

Code:
What you wrote (mostly intact)                                           My interpretation
*filter                                                                  # These are the default chains: input, forward, and output
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
#:OUTPUT DROP [0:0]                                                      # This output is commented out, but would default DROP all outbound traffic
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT                  # These next two allow all traffic related to allowed and established traffic
-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#-A INPUT -p icmp -j ACCEPT                                              # Like above, this would globally ACCEPT all ICMP traffic if not commented
-A INPUT -i lo -j ACCEPT                                                 # These two accept all incoming and outgoing traffic on the loopback address
-A OUTPUT -o lo -j ACCEPT

############## PRIVATE HOME NETWORK RULES (192.168.10.x)                                              # Changed all .10.x to .0.x to match my network setup

#icmp
-A INPUT -p icmp -s 192.168.10.0/24 -j ACCEPT                                                         # ICMP is just for ping, and troubleshooting connectivity
#dns (if you plan on using as a DNS server then uncomment following two rules)                        # Not creating a DNS or DHCP server, so leaving these inactive
#-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m tcp --dport 53 -j ACCEPT
#-A INPUT -p udp -s 192.168.10.0/24 -m state --state NEW -m udp --dport 53 -j ACCEPT
#dhcp (if you plan on using as a DHCP server then uncomment following two rules)
#-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m multiport --dports 67,68 -j ACCEPT
#-A INPUT -p udp -s 192.168.10.0/24 -m state --state NEW -m multiport --dports 67,68 -j ACCEPT

############### FILE SHARING RULES                                                                    # These rules create the initial connection of a computer requesting
#netbios                                                                                              # some resource from the server. The rules at the beginning referring
-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m tcp --dport 139 -j ACCEPT                  # to established connections are referring to connections that start here.
#Samba Share
-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m tcp --dport 445 -j ACCEPT
############### END FILE SHARING RULES

#ssh
-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m tcp --dport 22 -j ACCEPT                   # I'm changing this to: -A INPUT -p tcp -s 192.168.0.0/24
                                                                                                                              -m mac --mac-source MY:MAC:HERE
# END PRIVATE HOME NETWORK RULES (192.168.10.x)                                                                               -m state --state NEW -m tcp --dport 22 -j ACCEPT
########################################################################                              # which should exclude everything but my computer, explicitly

########################################################################
# PUBLIC INTERNET RULES

-A INPUT -p tcp -m state --state NEW -m tcp --dport 25565 -j ACCEPT                                   # The Minecraft connection request being allowed       

# END PUBLIC INTERNET RULES
########################################################################


#any rules not matching INPUT/FORWARD conditions will be dropped using the following rules.           # I believe these send errors to anyone trying anything
-A INPUT -j REJECT --reject-with icmp-host-prohibited                                                 # not allowed above. The last line starts logging dropped  
-A FORWARD -j REJECT --reject-with icmp-host-prohibited                                               # packets or something if more than 5 errors are created
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7                 # in a minute. Not sure the specifics of what is being logged.
COMMIT
So, all I really did was add a mac filter to the SSH connections. Any reason it won't work the way I did it? Also, why did you start with *filter and end with COMMIT?
 
Old 02-24-2013, 09:31 AM   #10
sag47
Senior Member
 
Registered: Sep 2009
Location: Orange County, CA
Distribution: Kubuntu x64, Raspbian, CentOS
Posts: 1,832
Blog Entries: 36

Rep: Reputation: 451Reputation: 451Reputation: 451Reputation: 451Reputation: 451
*filter is the default table. See the iptables man page (man iptables and search for filter with /). The COMMIT keyword tells iptables it should commit all rules currently in the pipeline to the kernel. If a commit is never executed then the specified rules will never be active.

You should only use a # (hash comment) at the beginning of a line. I don't know how iptables will behave adding it to the end of a rule (probably poorly). Also, you have comments listed that don't start with # when you're talking about adding the -m mac. I don't know if those are your actual rules or you were just demonstrating the change you were going to make. In that case just post your actual changes; I'll be able to tell where you changed it.

If you want to add comments as part of the rule then I recommend the comment module.
Code:
... -m comment --comment "my local LAN" ...
Make use of man page keyboard shortcuts when browsing the pages.

This should work
Code:
-A INPUT -p tcp -s 192.168.10.0/24 -m state --state NEW -m mac --mac-source MY:MAC:HERE -m tcp --dport 22 -j ACCEPT

Last edited by sag47; 02-24-2013 at 07:06 PM.
 
Old 02-24-2013, 08:59 PM   #11
JoseCuervo
Member
 
Registered: May 2007
Location: North Carolina
Distribution: Debian 8+, RHEL 7, Fedora22, CentOS7, Ubuntu 14.04
Posts: 74

Original Poster
Rep: Reputation: 18
Problem with starting Iptables on Bootup

When Ubuntu boots now, I can't see it on the network. If I disable the iptables I can see it fine though. Which part of this iptables did I screw up?

Code:
# Generated by iptables-save v1.4.12 on Sun Feb 24 11:30:47 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [11:754]

# Accept established traffic & loopback traffic
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT

# Accept Samba traffic from local network
-A INPUT -p udp -s 192.168.0.0/24 -m udp --dport 137 -j ACCEPT
-A INPUT -p udp -s 192.168.0.0/24 -m udp --dport 138 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m state --state NEW -m tcp --dport 139 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m state --state NEW -m tcp --dport 445 -j ACCEPT

# Accept SSH connections only from Viki (my computer's name is Viki, and the MAC is removed)
-A INPUT -s 192.168.0.0/24 -p tcp -m state --state NEW -m mac --mac-source xx:xx:xx:xx:xx:xx-m tcp --dport 22 -j ACCEPT

# Accept Minecraft from local network only, for now
-A INPUT -s 192.168.0.0/24 -p tcp -m state --state NEW -m tcp --dport 25565 -j ACCEPT

# Reject all other INPUT connections and packets
-A INPUT -j REJECT --reject-with icmp-host-prohibited

# Reject all forwarded traffic
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

# Allow web traffic OUPTPUT
-A OUTPUT -d 91.189.92.200/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A OUTPUT -d 91.189.91.13/32 -p tcp -m tcp --dport 80 -j ACCEPT

# Allow OUTPUT to update Ubuntu
-A OUTPUT -p tcp --dport 80 -d security.ubuntu.com -j ACCEPT
-A OUTPUT -p tcp --dport 80 -d us.archive.ubuntu.com -j ACCEPT

# Reject all other OUTPUT
-A OUTPUT -j REJECT --reject-with icmp-host-unreachable
COMMIT
# Completed on Sun Feb 24 11:30:47 2013
I have /etc/network/interfaces set to load the pre-up iptables when the computer starts, and that stops Ubuntu from using the internet or being visible. I've obviously missed something somewhere. This is what the last three lines of my /etc/network/interfaces looks like:

Code:
auto eth0
iface eth0 inet dhcp
# pre-up iptables-restore < /etc/iptables.rules
Ubuntu works fine when the last line is commented out, but otherwise has network problems. I'm going to start commenting rules in order to find which one is to blame. How else can I test this problem further, or do you see an easy fix right away? Thanks for being so patient with the same problem!

Also: I've been editing in vim and it's showing colors strangely. It won't always show a commented line as blue, for instance, and I can't find the answers on Google ANYWHERE.
 
Old 02-24-2013, 11:11 PM   #12
sag47
Senior Member
 
Registered: Sep 2009
Location: Orange County, CA
Distribution: Kubuntu x64, Raspbian, CentOS
Posts: 1,832
Blog Entries: 36

Rep: Reputation: 451Reputation: 451Reputation: 451Reputation: 451Reputation: 451
Quote:
Originally Posted by JoseCuervo View Post
When Ubuntu boots now, I can't see it on the network. If I disable the iptables I can see it fine though. Which part of this iptables did I screw up?
What do you mean you can't see it on the network? You can't SSH? You can't telnet services? nmap shows all ports closed? What are you using to detect that it is "on the network" the way you expect?

Quote:
Originally Posted by JoseCuervo View Post
I have /etc/network/interfaces set to load the pre-up iptables when the computer starts, and that stops Ubuntu from using the internet or being visible. I've obviously missed something somewhere. This is what the last three lines of my /etc/network/interfaces looks like:

Code:
auto eth0
iface eth0 inet dhcp
# pre-up iptables-restore < /etc/iptables.rules
Rather than rebooting your machine several times to test that /etc/network/interfaces configuration you can just flush and reload the rules until you get a working configuration that you can live with. For instance to flush the iptables rules...
Code:
iptables -F
List the rules in iptables (to check they were flushed or that your own rules were loaded)
Code:
iptables -L
Restore your own iptables rules to check if they're working.
Code:
iptables-restore < /etc/iptables.rules
As always you can read the man pages about those two commands to learn more.
Code:
man iptables
man iptables-restore
Quote:
Originally Posted by JoseCuervo View Post
Ubuntu works fine when the last line is commented out, but otherwise has network problems. I'm going to start commenting rules in order to find which one is to blame. How else can I test this problem further, or do you see an easy fix right away? Thanks for being so patient with the same problem!
Your problem is likely the OUTPUT rules. Get rid of them all initially and see that your system is working. Until you have a working system from the outside in; don't start configuring rules for the inside out. For configuration of outbound rules for your system you really have to know what kind of applications you require connectivity/where/how/why.

You could use tcpdump (similar to wireshark for analyzing network traffic on an interface) to troubleshoot how and what applications are trying to communicate outbound. Then you can start designing a set of rules for what applications should be able to communicate.

So first get rid of OUTPUT rules and work from there. Remember to use the quick shortcuts I gave you earlier for flushing and restoring the rules so you're not restarting the system a lot; it will save you time.

Quote:
Originally Posted by JoseCuervo View Post
Also: I've been editing in vim and it's showing colors strangely. It won't always show a commented line as blue, for instance, and I can't find the answers on Google ANYWHERE.
Don't worry about the vim colors. I have the same problem with vim colorizing my iptables rules on Ubuntu. I don't know which color scheme it's using but the colors were not designed for iptables-save/restore scripts (maybe some other script type?). If you really want to change that then perhaps install a vim syntax plug-in designed to handle coloring iptables scripts.

Last edited by sag47; 02-24-2013 at 11:13 PM.
 
Old 02-25-2013, 12:18 AM   #13
JoseCuervo
Member
 
Registered: May 2007
Location: North Carolina
Distribution: Debian 8+, RHEL 7, Fedora22, CentOS7, Ubuntu 14.04
Posts: 74

Original Poster
Rep: Reputation: 18
Found the problem

I found the rule that is causing the problem, a global deny outgoing rule. I checked iptables -L and it comes after all of the other rules, so I'm not sure why it's not working. Anyway, I've disabled it for now, until I can figure out which services to explicitly allow out before it is executed. Thanks for the flush and update hints, those save about a minute each time, multiplied by a million times lol.
 
Old 02-26-2013, 01:14 AM   #14
JoseCuervo
Member
 
Registered: May 2007
Location: North Carolina
Distribution: Debian 8+, RHEL 7, Fedora22, CentOS7, Ubuntu 14.04
Posts: 74

Original Poster
Rep: Reputation: 18
Thanks a ton Sag47, I'm going to start a thread in the security forum to work specifically on the firewall rules that I need to develop. I particularly appreciate how detailed you've been with your answers, and how many problems you've worked me through in the last week. I already love Ubuntu more than I can say, and I've been a dedicated Windows fan for a long time.
 
Old 02-26-2013, 09:21 AM   #15
sag47
Senior Member
 
Registered: Sep 2009
Location: Orange County, CA
Distribution: Kubuntu x64, Raspbian, CentOS
Posts: 1,832
Blog Entries: 36

Rep: Reputation: 451Reputation: 451Reputation: 451Reputation: 451Reputation: 451
Cool, enjoy!
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] Help me open a port for my Minecraft server Lumify Linux - Newbie 8 07-29-2012 02:52 PM
[SOLVED] Rewriting a script for running a minecraft server on Ubuntu Server cowboys1919 Linux - Server 7 07-11-2012 11:36 AM
[SOLVED] 1337 Minecraft Server enorbet Slackware 4 03-20-2011 06:45 PM
Having issues with installing Minecraft.bin file scathysg Linux - Newbie 8 01-14-2011 03:59 AM


All times are GMT -5. The time now is 01:18 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration