iptables rules still working after being flushed (?)

iptables rules still working after being flushed (?)

[Santiago Vila]

Hello.

I have a system where iptables rules still work after being flushed.
Yes, I know this will sound as an "X-File" or "The Twilight Zone",
but that's exactly what happens.

I've reported this problem to Debian here:

http://bugs.debian.org/780494

Unfortunately, I can only reproduce it on a server used by many
people, so I can't make a lot of experiments there.

The system is running Debian jessie, with Linux 3.16.7 and iptables 1.4.21
(and also systemd, in case it matters).

Simple questions:

* Is there any kind of "version coupling" between Linux and iptables?

(Say, "your kernel is too old / too new for the iptables version you are using")

If so: How am I supposed to know if iptables does not complain?

* Is there a reason why "iptables -L -n" could not be showing the *real*
tables being used?

* Any known bug (already fixed in the latest version) in Linux 3.16.7
or iptables 1.4.21 that may be the reason for this strange behaviour?

Thanks.

Re: iptables rules still working after being flushed (?)

[Santiago Vila]

On Sun, Mar 15, 2015 at 12:21:19PM -0400, John Lauro wrote:
> As far as I know, when there is version coupling, it's only impacted those
> rules out of sync or missing between versions, and it's been pretty good
> about complaining.
> 
> iptables -L -n will not show all the tables (just the filter tables, and so
> you probably didn't flush all the tables.  There is also tables for nat,
> security, raw, and mangle.)
> Try running
> iptables-save  (it just goes to stdout so it doesn't save it anywhere
> besides your terminal unless you tell it to)

Thanks a lot for trying, but no, that's not the problem.

I have never used any of those tables, so I would not need to flush
them, but in either case, and to be sure:

for t in nat security raw mangle; do iptables -t $t -L -n; done

Output:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination


and still I can't make more than 19 ssh connections in a row.

Where are the old tables stored and why do they work after I deleted them?

See what I said this is an X-File?

Re: iptables rules still working after being flushed (?)

[Bastian Bittorf]

* Santiago Vila <sanvila@unex.es> [15.03.2015 20:11]:
> and still I can't make more than 19 ssh connections in a row.

this sounds like an sshd-issue - check:
grep Max /etc/ssh/sshd_config

bye, bastian

Re: iptables rules still working after being flushed (?)

[Santiago Vila]

Finally I found a likely explanation.

What I did: Put "exit 0" at the top of the firewall script and reboot.

I can ssh 30 times in a row from a nearby computer, but I still can't
do the same from my computer at home.

So this surely must be the result of some corporate firewall rule at
my Universiry which I can't control. Grrr.

Sorry for the false alarm.