-1

I have created an iptables config which I thought that I understood, however it seems to be preventing munin from generating graphs and I'm not sure why. If I disable iptables, munin will generate graphs as expected. I have included my iptables config and munin config. Does anyone see how munin is being blocked? Munin should only be connecting and listening on the loopback device.

iptables config:

*filter

# Drop everything by default
:INPUT DROP [0:0]

# We are not routing packets
:FORWARD DROP [0:0]

# Don't filter output
:OUTPUT ACCEPT [0:0]

# Add the fail2ban chain
:fail2ban-SSH - [0:0]

# Drop NULL packets
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# Reject a syn-flood attack
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# Drop XMAS packets
-A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# We want the response packets...
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Accept all from loopback
-A INPUT -i lo -j ACCEPT

# Send packets for port 22 to fail2ban, it may drop them
-A INPUT -p tcp -m tcp --dport 22 -j fail2ban-SSH
-A fail2ban-SSH -j RETURN
# If fail2ban didn't drop it let it on through
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

# HTTP(S)
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Relevant porition of munin config:

# A list of addresses that are allowed to connect.  This must be a
# regular expression, since Net::Server does not understand CIDR-style
# network notation unless the perl module Net::CIDR is installed.  You
# may repeat the allow line as many times as you'd like

allow ^127\.0\.0\.1$
allow ^::1$

# Which address to bind to;
host *
# host 127.0.0.1

# And which port
port 4949
ellipse-of-uncertainty
  • 166
  • 1
  • 8

1 Answers1

3

From the man page for iptables:

every packet only passes through one of the three chains (except loopback traffic, which involves both INPUT and OUTPUT chains);

In other words, loopback traffic does get caught by iptables, as you've now discovered...

I'd suggest something like the following:

-A INPUT -p tcp -m tcp -s 127.0.0.1 -d 127.0.0.1 --dport 4949 -j ACCEPT
Jenny D
  • 27,780
  • 21
  • 75
  • 114