Subject: [alpine-devel] edge 120403: bug in netfilter?

From: Leonardo <[email-masked]>
Date: Fri, 13 Apr 2012 08:53:36 +0200

Hi,

I have an edge box with latest edge snapshot with shorewall installed.
Once logged remotely via ssh I've setup and started Shorewall with the
following rule:

ACCEPT		all		fw		tcp	22

After that, I'm no longer able to establish new ssh connections from any
IP address.

Thinking of a Shorewall issue (hoping to see AWall soon! Thanks kunkku!)
I did "shorewall clear", and I was able to login via ssh again. 

So, instead of Shorewall, I've setup plain iptables rules:

iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I INPUT -d $MYIP -p tcp --dport 22 -j ACCEPT

I didn't change the default INPUT policy (ACCEPT). After that, again, I
wasn't able to login via ssh anymore.

Anybody noticed the same issue, or am I missing something obvious?

Thanks

- leonardo

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Natanael Copa <[email-masked]>
Date: Fri, 13 Apr 2012 22:15:35 +0200

On Fri, 13 Apr 2012 08:53:36 +0200
Leonardo <[email-masked]> wrote:

> ACCEPT		all		fw		tcp
> 22
> After that, I'm no longer able to establish new ssh connections from
> any IP address.
> 
> Thinking of a Shorewall issue (hoping to see AWall soon! Thanks
> kunkku!) I did "shorewall clear", and I was able to login via ssh
> again. 
> 
> I didn't change the default INPUT policy (ACCEPT). After that, again,
> I wasn't able to login via ssh anymore.
> 

Did you add the interface to any zone?

-nc

---

---

From: Leonardo Arena <[email-masked]>
Date: Sat, 14 Apr 2012 08:22:31 +0200

> Did you add the interface to any zone?

Yes, of course. Zones, Interfaces and Policy are fully configured.
Doesn't look like it's a Shorewall issue, as I was able to reproduce
it with iptables only.

- leonardo

---

---

From: Leonardo Arena <[email-masked]>
Date: Mon, 16 Apr 2012 08:08:36 +0200

> Doesn't look like it's a Shorewall issue, as I was able to reproduce

"iptables -L E2fw -vn shows that the ACCEPT rule isn't matched (0 pkts).
I can observe the same behaviour with the following rule too:

ACCEPT		inet:$MYIP	fw		udp	514

Incoming syslog packets aren't matched by the rule. It seems that they
are dropped early.
All dropped packets are logged via "info" but I don't see any dropped
packet in busybox syslog.

- leonardo

---