exception with 'nat' chain on version 0.8.0

[rtkwlf]

exception with 'nat' chain on version 0.8.0

[rtkrruvinskiy]

Can you attach the /etc/iptables-rules (Debian/Ubuntu) or /etc/sysconfig/iptables (CentOS/Fedora/Red Hat) files generated with the two versions of the cookbook? Thanks!

[anuriq]

Content of /etc/sysconfig/iptables-config with cookbook 0.8.0

# Load additional iptables modules (nat helpers)
#   Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES=""

# Unload modules on restart and stop
#   Value: yes|no,  default: yes
# This option has to be 'yes' to get to a sane state for a firewall
# restart or stop. Only set to 'no' if there are problems unloading netfilter
# modules.
IPTABLES_MODULES_UNLOAD="yes"

# Save current firewall rules on stop.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
# (e.g. on system shutdown).
IPTABLES_SAVE_ON_STOP="no"

# Save current firewall rules on restart.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
# restarted.
IPTABLES_SAVE_ON_RESTART="no"

# Save (and restore) rule and chain counter.
#   Value: yes|no,  default: no
# Save counters for rules and chains to /etc/sysconfig/iptables if
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
# SAVE_ON_RESTART is enabled.
IPTABLES_SAVE_COUNTER="no"

# Numeric status output
#   Value: yes|no,  default: yes
# Print IP addresses and port numbers in numeric format in the status output.
IPTABLES_STATUS_NUMERIC="yes"

# Verbose status output
#   Value: yes|no,  default: yes
# Print info about the number of packets and bytes plus the "input-" and
# "outputdevice" in the status output.
IPTABLES_STATUS_VERBOSE="no"

# Status output with numbered lines
#   Value: yes|no,  default: yes
# Print a counter/number for every rule in the status output.
IPTABLES_STATUS_LINENUMBERS="yes"

# Reload sysctl settings on start and restart
#   Default: -none-
# Space separated list of sysctl items which are to be reloaded on start.
# List items will be matched by fgrep.
#IPTABLES_SYSCTL_LOAD_LIST=".nf_conntrack .bridge-nf"

[rtkrruvinskiy]

I'm looking for the rule file, not the configuration file. What Linux distribution and version are you running?

[anuriq]

This is a Virtuozzo Server 6 which is based on Centos 6. A file you requested was absent :-)

[rtkrruvinskiy]

The simple_iptables::default recipe has a line that reads "File.delete(iptable_rules)". Can you comment it out, and run chef again? The file I'm looking for should be there at that point.

[anuriq]

hi again. contents of /etc/sysconfig/iptables:

# This file generated by Chef. Changes will be overwritten.
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
# This file generated by Chef. Changes will be overwritten.
*mangle
:PREROUTING ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
# This file generated by Chef. Changes will be overwritten.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:nrpe - [0:0]
:PVA-INPUT - [0:0]
:storage - [0:0]
:migration - [0:0]
:pstorage - [0:0]
-A INPUT --jump ACCEPT -m conntrack --ctstate ESTABLISHED,RELATED -m comment --comment "established"
-A INPUT -p tcp --jump PVA-INPUT
-A PVA-INPUT --jump ACCEPT -p tcp -m tcp --dport 4533 -m comment --comment "pva-input"
-A PVA-INPUT --jump ACCEPT -p tcp -m tcp --dport 4534 -m comment --comment "pva-input"
-A PVA-INPUT --jump ACCEPT -p tcp -m tcp --dport 4433 -m comment --comment "pva-input"
-A PVA-INPUT --jump ACCEPT -p tcp -m tcp --dport 4434 -m comment --comment "pva-input"
-A PVA-INPUT --jump ACCEPT -p tcp -m tcp --dport 4435 -m comment --comment "pva-input"
-A PVA-INPUT --jump ACCEPT -p tcp -m tcp --dport 5800:5899 -m comment --comment "pva-input"
-A PVA-INPUT --jump ACCEPT -p tcp -m tcp --dport 4643 -m comment --comment "pva-input"
-A PVA-INPUT --jump ACCEPT -p tcp -m tcp --dport 8443 -m comment --comment "pva-input"
-A FORWARD --jump ACCEPT  -m comment --comment "foward"
-A INPUT --jump ACCEPT --proto icmp -m comment --comment "icmp"
-A INPUT --jump ACCEPT --in-interface lo -m comment --comment "loopback"
-A INPUT -i bond0.219 --jump storage
-A storage --jump ACCEPT -s 192.168.0.0/24 -m comment --comment "storage"
-A INPUT  --jump nrpe
-A nrpe --jump ACCEPT -i eth0 --proto tcp --dport 5666 -m state --state NEW -m comment --comment "nrpe"
-A INPUT  --jump migration
-A migration --jump ACCEPT -p tcp --dport 64000 -m comment --comment "migration"
-A INPUT  --jump pstorage
-A pstorage --jump ACCEPT -i bond0 -s 192.168.0.0/24 -m comment --comment "pstorage"
-A INPUT --jump ACCEPT --proto tcp --dport 22 -m conntrack --ctstate NEW -m comment --comment "ssh"
-A INPUT --jump REJECT --reject-with icmp-host-prohibited  -m comment --comment "reject"
-A FORWARD --jump REJECT --reject-with icmp-host-prohibited  -m comment --comment "reject"
COMMIT
# Completed
# This file generated by Chef. Changes will be overwritten.
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed

[rtkrruvinskiy]

Thanks for sending me the file. To confirm, this file fails to load for you on your Virtuozzo server? But when you run version 0.7.5, it works fine? Is there a difference between the contents of the /etc/sysconfig/iptables file generated by version 0.7.5 and version 0.8.0?

[anuriq]

difference is in nat and raw blocks. they are absent in version 0.7.5

2,8d1
< *nat
< :PREROUTING ACCEPT [0:0]
< :OUTPUT ACCEPT [0:0]
< :POSTROUTING ACCEPT [0:0]
< COMMIT
< # Completed
< # This file generated by Chef. Changes will be overwritten.
51,56d43
< # Completed
< # This file generated by Chef. Changes will be overwritten.
< *raw
< :PREROUTING ACCEPT [0:0]
< :OUTPUT ACCEPT [0:0]
< COMMIT

[rtkrruvinskiy]

I wonder if the switch from normal to default attributes is interfering with something you're doing to get around the fact that the raw and nat tables aren't available in your container. Do you have any code in any of your recipes that looks something like this?

node.set["simple_iptables"]["tables"] = %w(filter mangle)

Regardless, try to override the attribute. In a recipe, try writing this:

node.override["simple_iptables"]["tables"] = %w(filter mangle)

You can also do something equivalent in a role via override_attributes.

[anuriq]

thank you, this really resolved the issue.