[Spce-user] Possible Bug? - NGCP Firewall in mr6.5.3

[Hohl Matthias]

Oh okay…

Last update i did 2 weeks ago.

It looks like no fixes in there…

I will do the update immediately.

 

Btw: what about my ETH1 interface? 

How can I enable my standard rules also for eth1?

 

thanks

 

Von: Spce-user <spce-user-bounces at lists.sipwise.com> Im Auftrag von Richard Fuchs
Gesendet: Dienstag, 2. April 2019 15:24
An: spce-user at lists.sipwise.com
Betreff: Re: [Spce-user] Possible Bug? - NGCP Firewall in mr6.5.3

 

On 02/04/2019 09.18, Hohl Matthias wrote:

Hello,

 

i configured the new NGCP Firewall in my config.yml file and apply it with ngcpcfg apply and my iptables looks like this:

 

root at spce:~# iptables -L -n -v

Chain INPUT (policy ACCEPT 3139 packets, 517K bytes)

pkts bytes target     prot opt in     out     source               destination

3139  517K f2b-KAMAILIO  all  --  *      *       0.0.0.0/0            0.0.0.0/0

3142  518K f2b-KAMAILIO  all  --  *      *       0.0.0.0/0            0.0.0.0/0

3174  522K rtpengine  all  --  *      *       0.0.0.0/0            0.0.0.0/0

 

 

Now I apply the iptables filter with iptables-apply. Now it looks like this:

 

root at spce:~# iptables -L -n -v

Chain INPUT (policy DROP 1 packets, 40 bytes)

pkts bytes target     prot opt in     out     source               destination

   45 10017 f2b-KAMAILIO  all  --  *      *       0.0.0.0/0            0.0.0.0/0

   49 10197 f2b-KAMAILIO  all  --  *      *       0.0.0.0/0            0.0.0.0/0

   58 31203 rtpengine  udp  --  *      *       0.0.0.0/0            0.0.0.0/0

   53 26575 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0

   45  9670 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8

    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 0

    3   841 cluster    all  --  *      *       0.0.0.0/0            0.0.0.0/0

    1   761 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            udp dpt:5060 /* sip_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5060 /* sip_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5061 /* sip_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5222 /* sip_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5269 /* sip_ext */

    0     0 ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            udp dpts:30000:44999 /* rtp_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443 /* web_ext */

    0     0 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1443 /* web_int */

    0     0 ACCEPT     tcp  --  eth0   *       92.42.136.52         0.0.0.0/0            tcp dpt:22 /* ssh_ext */

    2    80 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 5/min burst 10 LOG flags 0 level 7 prefix "NGCPFW[DROP]: "

 

 

So far so good BUT if I reboot the machine now, the iptables policies are removed and it looks like before I did the “iptables-apply” command.

So I have to “iptables-apply” again, to have my iptables rules installed.

The iptables settings are not reboot resistant.

 

I read the handbook carefully several times, but can’t find a solution for this behavior. Is this a bug?

 

This was just recently fixed. Are your packages all up to date? Templates should be at least 6.5.3.19 and rtpengine should be at least 6.5.3.4.

Cheers

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/attachments/20190402/6137e0c7/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5585 bytes
Desc: not available
URL: <http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/attachments/20190402/6137e0c7/attachment-0001.p7s>