iptables behaviour: sendmsg: Operation mot permitted

phsythax · 04-24-2007, 02:21 PM

I did a # emerge --sync && emerge -Du world

and suddenly, (or it was another caus) my internet connection froze, i tried to ping google but "host not found" or something like that was all i got, followed by "sendmsg: Operation mot permitted", So i turned off iptables and my connection got alive again.

I tried flushing (# iptables -F) and entering my firewall rules again, followed by a # /etc/init.d/iptables start then the connection froze again, so i turned off my firewall once more. I have no idea whatsoever what the cause might be. THis is my firewall configuration:

Code:

# cat /var/lib/iptables/rules-save
# Generated by iptables-save v1.3.5 on Tue Apr 24 18:03:48 2007
*raw
:PREROUTING ACCEPT [39627:21086534]
:OUTPUT ACCEPT [25503:1359984]
COMMIT
# Completed on Tue Apr 24 18:03:48 2007
# Generated by iptables-save v1.3.5 on Tue Apr 24 18:03:48 2007
*mangle
:PREROUTING ACCEPT [163:30511]
:INPUT ACCEPT [155:27739]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [218:11937]
:POSTROUTING ACCEPT [47:2081]
COMMIT
# Completed on Tue Apr 24 18:03:48 2007
# Generated by iptables-save v1.3.5 on Tue Apr 24 18:03:48 2007
*filter
:INPUT DROP [51:13070]
:FORWARD DROP [0:0]
:OUTPUT DROP [171:9856]
:INBOUND - [0:0]
:LOG_FILTER - [0:0]
:LSI - [0:0]
:LSO - [0:0]
:OUTBOUND - [0:0]
COMMIT
# Completed on Tue Apr 24 18:03:48 2007

Matir · 04-24-2007, 02:25 PM

Your iptables rules drop all packets: ":INPUT DROP [51:13070]"

phsythax · 04-24-2007, 02:38 PM

Quote:

Originally Posted by Matir

Your iptables rules drop all packets: ":INPUT DROP [51:13070]"

How can that be? i ran the # iptables -F command

Matir · 04-24-2007, 02:52 PM

Where did you enter your rules? If you entered the iptables commands directly, then they were overwritten by /etc/init.d/iptables start, which loads from the locally stored ruleset.

win32sux · 04-24-2007, 02:52 PM

Quote:

Originally Posted by phsythax

How can that be? i ran the # iptables -F command

because flushing doesn't affect the chain's policy...

to really clean-out your iptables rules, use something like this:

Code:

#!/bin/sh

IPT="/sbin/iptables"

$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT

$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P INPUT ACCEPT
$IPT -t mangle -P FORWARD ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT
$IPT -t mangle -P POSTROUTING ACCEPT

$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT

$IPT -F
$IPT -F -t nat
$IPT -F -t mangle

$IPT -X
$IPT -X -t nat
$IPT -X -t mangle

then set the iptables rules you want, and save new the config to wherever your distro's startup scripts look for it... for example:

Code:

iptables-save > /etc/sysconfig/iptables

phsythax · 04-24-2007, 03:18 PM

Quote:

Originally Posted by Matir

Your iptables rules drop all packets: ":INPUT DROP [51:13070]"

Okey, so that was the problem, i wounder how it got there. Thanks for the help, my firewall works as it should now.