WIKIABOUT

FOR TIPS, gUIDES & TUTORIALS

subscribe to our Youtube

GO TO YOUTUBE

14455 questions

17168 answers

28195 comments

0 members

Most popular tags

rut955 rut240 rut950 rutx11 rms vpn to openvpn wifi not sms trb140 firmware connection - ipsec on rutx12 rutx09 modbus
We are migrating to our new platform at https://community.teltonika.lt. Moving forward, you can continue discussions on this new platform. This current platform will be temporarily maintained for reference purposes.

iptables, repeatable rule from firewall.user

0 votes
421 views 6 comments
by anonymous

Hi,

I add the rule in /etc/firewall.user:

iptables -t filter -I INPUT 2 -s X.X.X.X/32 -j DROP.

After reboot or executing "/etc/init.d/firewall restart", this rule appears in output of the command "itables -t filter --list-rules":

..........

-N zone_wan_src_REJECT

-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -m comment --comment "!fw3: user chain for input" -j input_rule

......................

It`s all good. But later output of the command "itables -t filter --list-rules" changed:

..............................

-N zone_wan_src_REJECT

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT

-A INPUT -m comment --comment "!fw3: user chain for input" -j input_rule

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT

.......................................

A few minutes later numbers of string "-A INPUT -s X.X.X.X/32 -j DROP" had increased even more...:

.......

-N zone_wan_src_REJECT

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT

-A INPUT -m comment --comment "!fw3: user chain for input" -j input_rule

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "!fw3" -j ACCEPT

...............

Why my rule from /etc/firewall.user dublicated ?

My device: Teltonika RUT900 3G ,fw: RUT9XX_R_00.06.09.2

Thanks!

1 Answer

0 votes
by anonymous

Hello,

I was not able to replicate the issue. 

Could you tell, which device and which firmware did you experience this behavior?

Could you share a troubleshoot file? Please, replicate the issue, then access router's WebUI, go to System -> Administration -> Troubleshoot section and download troubleshoot file from there. The logs in the file might provide more insight into the issue.

Attached files are private and visible only to Teltonika Moderators.

Best regards,

by anonymous

Could you try this workaround:

iptables -t filter -C INPUT 2 -s X.X.X.X/32 -j DROP || iptables -t filter -I INPUT 2 -s X.X.X.X/32 -j DROP

to check the presence of the rule before (re)-adding it.

by anonymous

I has added your command string in /etc/firewall.user, but changed a little:

iptables -t filter -C INPUT -s X.X.X.X/32 -j DROP || iptables -t filter -I INPUT 2 -s X.X.X.X/32 -j DROP

and also I try this version: 

 iptables -t filter -C INPUT -s X.X.X.X/32 -j DROP || iptables -t filter -I INPUT 3 -s X.X.X.X/32 -j DROP

For both versions the output "iptables --list-rules":

................

-N zone_wan_src_REJECT

-A INPUT -s X.X.X.X/32 -j DROP

-A INPUT -i lo -m comment --comment "!fw3" -j ACCEPT

-A INPUT -m comment --comment "!fw3: user chain for input" -j input_rule

..........................................................
Yes! It does not change over time!
For some reason, position number of our rule in chain INPUT always 1? 

by anonymous
By default, -I INPUT sets the new rule at position 1. -I INPUT n sets it at position n.
by anonymous

yes, but my command was:

iptables -t filter -I INPUT 2 -s X.X.X.X/32 -j DROP  and

iptables -t filter -I INPUT 3 -s X.X.X.X/32 -j DROP

buy rule appears in position 1...?

by anonymous
No idea why the rule ends up in position 1. Is there something else manipulating the iptables ?
by anonymous
No, only my commands in the file /etc/firewall.user... everything else is by default.

it is not clear when exactly this file is executed and how many times.

I solved this problem to add my rules in file /etc/rc.local.

the rules stopped being duplicated.