[Spce-user] Possible Bug? - NGCP Firewall in mr6.5.3

[Hohl Matthias]

Hello,

 

i configured the new NGCP Firewall in my config.yml file and apply it with
ngcpcfg apply and my iptables looks like this:

 

root at spce:~# iptables -L -n -v

Chain INPUT (policy ACCEPT 3139 packets, 517K bytes)

pkts bytes target     prot opt in     out     source
destination

3139  517K f2b-KAMAILIO  all  --  *      *       0.0.0.0/0
0.0.0.0/0

3142  518K f2b-KAMAILIO  all  --  *      *       0.0.0.0/0
0.0.0.0/0

3174  522K rtpengine  all  --  *      *       0.0.0.0/0            0.0.0.0/0

 

 

Now I apply the iptables filter with iptables-apply. Now it looks like this:

 

root at spce:~# iptables -L -n -v

Chain INPUT (policy DROP 1 packets, 40 bytes)

pkts bytes target     prot opt in     out     source
destination

   45 10017 f2b-KAMAILIO  all  --  *      *       0.0.0.0/0
0.0.0.0/0

   49 10197 f2b-KAMAILIO  all  --  *      *       0.0.0.0/0
0.0.0.0/0

   58 31203 rtpengine  udp  --  *      *       0.0.0.0/0
0.0.0.0/0

   53 26575 ACCEPT     all  --  lo     *       0.0.0.0/0
0.0.0.0/0

   45  9670 ACCEPT     all  --  *      *       0.0.0.0/0
0.0.0.0/0            state RELATED,ESTABLISHED

    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0            icmptype 8

    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0
0.0.0.0/0            icmptype 0

    3   841 cluster    all  --  *      *       0.0.0.0/0
0.0.0.0/0

    1   761 ACCEPT     udp  --  eth0   *       0.0.0.0/0
0.0.0.0/0            udp dpt:5060 /* sip_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:5060 /* sip_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:5061 /* sip_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:5222 /* sip_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:5269 /* sip_ext */

    0     0 ACCEPT     udp  --  eth0   *       0.0.0.0/0
0.0.0.0/0            udp dpts:30000:44999 /* rtp_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:443 /* web_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0
0.0.0.0/0            tcp dpt:1443 /* web_int */

    0     0 ACCEPT     tcp  --  eth0   *       92.42.136.52
0.0.0.0/0            tcp dpt:22 /* ssh_ext */

    2    80 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0            limit: avg 5/min burst 10 LOG flags 0 level 7 prefix
"NGCPFW[DROP]: "

 

 

So far so good BUT if I reboot the machine now, the iptables policies are
removed and it looks like before I did the "iptables-apply" command.

So I have to "iptables-apply" again, to have my iptables rules installed.

The iptables settings are not reboot resistant.

 

I read the handbook carefully several times, but can't find a solution for
this behavior. Is this a bug?

 

 

SECOND:

It looks like that the iptables-apply just set the rules for my eth0
interface, but not for eth1. How can I enable this rules for eth1 too?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sipwise.com/mailman/private/spce-user_lists.sipwise.com/attachments/20190402/de7fb381/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5585 bytes
Desc: not available
URL: <http://lists.sipwise.com/mailman/private/spce-user_lists.sipwise.com/attachments/20190402/de7fb381/attachment.p7s>