After edit firewall systems block outgoing

[Thomas Wilhelmi]

# cat /proc/net/ip_tables_matches

udplite
udp
tcp
icmp

# cat /proc/net/ip6_tables_matches

udplite
udp
tcp
icmp6

# cat /proc/net/ip_tables_names

mangle
nat
filter

# cat /proc/net/ip6_tables_names

nat
mangle
filter

Also post your machine virtualization type.

No Virtualisation.

 

[Nikolay.]

OK, thanks, Vincent W. In your case you can try to do following to fix firewall issue:

# iptables -A INPUT -m state --state INVALID -j DROP
# ip6tables -A INPUT -m state --state INVALID -j DROP

Then go to Panel and re-apply firewall configuration. Then more appropriate rules should be generated. In theory this should even work if you reboot your machine later.

Please tell us if it will help you.


Edit: Thanks, Thomas Wilhelmi. You may try the same recipe. Though I'm not 100% sure it will work for you.

 

[Vincent W.]

Nikolay,

Thank you very much!

I have processed the requested above and its working now! I can ping in to out, and dns is resolving.
I will test in our test lab with rebooting and adding rules, i let you know

 

[Thomas Wilhelmi]

Hello,

thx for the try. But it's not working. When I enter your command i get the Warning:

WARNING: The state match is obsolete. Use conntrack instead.

And after activating the Firewall-rules I have the same effect for no outgoing traffic.

 

[Nikolay.]

Hello,

thx for the try. But it's not working. When I enter your command i get the Warning:

WARNING: The state match is obsolete. Use conntrack instead.

And after activating the Firewall-rules I have the same effect for no outgoing traffic.

Hmm... What's your kernel and iptables versions?

 

[Thomas Wilhelmi]

uname -a

Linux h1431219 3.7.10-1.16-default #1 SMP Fri May 31 20:21:23 UTC 2013 (97c14ba) x86_64 x86_64 x86_64 GNU/Linux

iptables:

iptables-1.4.16.3-4.1.1.x86_64

 

[Nikolay.]

Sorry, Thomas Wilhelmi, but your case is beyond my ability to help at the moment. The issue would need to be patched by Parallels.

For the time being I advise you to either disable Firewall or set policy for incoming connections to allow in Firewall module.

 

[Thomas Wilhelmi]

Thx for your time and effort. I appreciate

 

[Vincent W.]

Thomas Wilhelmi, try instead

iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
ip6tables -A INPUT -m conntrack --ctstate INVALID -j DROP

Nikolay. , Thanks you the time! I hope that parralels will fix this soon, so that we don`t need to edit iptables manualy

 

[Thomas Wilhelmi]

WOW, thx a lot. And sorry for hijacking your thread. But I think this was really the same issue

 

[Thomas Wilhelmi]

Hm, that worked only for a couple of minutes than the traffic is blocked again.

 

[Nikolay.]

Thomas Wilhelmi, try instead

iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
ip6tables -A INPUT -m conntrack --ctstate INVALID -j DROP

Um... sorry to disappoint you, but this advice should not work for you, Thomas Wilhelmi. The purpose of these commands is not to add new rules (either useful or just syntactically correct ones), but to harness their side effects. Since your problems actually have slightly different causes, the same trick is inapplicable in your case.

You may consider it magic.

Nikolay. , Thanks you the time! I hope that parralels will fix this soon, so that we don`t need to edit iptables manualy

You're welcome.

Slight correction: note that technically you don't edit iptables rules manually. These commands are a one-time "incentive" that could have been phrased in a thousand other ways.

 

[Thomas Wilhelmi]

You may consider it magic.

I guess I have to and wait for Parralels as Vincent said:

I hope that parralels will fix this soon ...

Anyway, thanks for your time Folks

 

[Thomas Wilhelmi]

After update to MU5 the Problem still exists.

 

[Thomas Wilhelmi]

Is there any plan when this issue will be fixed?

 

[Kirill K]

After update to MU5 the Problem still exists.

Fix should be available in the next update.

 

[Thomas Wilhelmi]

Thx for the answer

 

[Thomas Wilhelmi]

Just installed MU#7 but no Change in Firewall-behaviour.

 

[Nikolay.]

Thomas Wilhelmi, please make sure you reapplied firewall policy. If error persists, post generated config.

 

[Thomas Wilhelmi]

I reapplied the Settings. Otherwise they wouldn't be active

Here is the generated config:

#!/bin/sh
#ATTENTION!
#
#DO NOT MODIFY THIS FILE BECAUSE IT WAS GENERATED AUTOMATICALLY,
#SO ALL YOUR CHANGES WILL BE LOST THE NEXT TIME THE FILE IS GENERATED.

set -e

echo 0 > /proc/sys/net/ipv4/ip_forward
([ -f /var/lock/subsys/ipchains ] && /etc/init.d/ipchains stop) >/dev/null 2>&1 || true
(rmmod ipchains) >/dev/null 2>&1 || true
/usr/sbin/iptables -F
/usr/sbin/iptables -X
/usr/sbin/iptables -Z
/usr/sbin/iptables -P INPUT DROP
/usr/sbin/iptables -P OUTPUT DROP
/usr/sbin/iptables -P FORWARD DROP
/usr/sbin/iptables -A INPUT -i lo -j ACCEPT
/usr/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/usr/sbin/iptables -A FORWARD -i lo -o lo -j ACCEPT
/usr/sbin/iptables -t mangle -F
/usr/sbin/iptables -t mangle -X
/usr/sbin/iptables -t mangle -Z
/usr/sbin/iptables -t mangle -P PREROUTING ACCEPT
/usr/sbin/iptables -t mangle -P OUTPUT ACCEPT
/usr/sbin/iptables -t mangle -P INPUT ACCEPT
/usr/sbin/iptables -t mangle -P FORWARD ACCEPT
/usr/sbin/iptables -t mangle -P POSTROUTING ACCEPT
/usr/sbin/ip6tables -F
/usr/sbin/ip6tables -X
/usr/sbin/ip6tables -Z
/usr/sbin/ip6tables -P INPUT DROP
/usr/sbin/ip6tables -P OUTPUT DROP
/usr/sbin/ip6tables -P FORWARD DROP
/usr/sbin/ip6tables -A INPUT -i lo -j ACCEPT
/usr/sbin/ip6tables -A OUTPUT -o lo -j ACCEPT
/usr/sbin/ip6tables -A FORWARD -i lo -o lo -j ACCEPT
/usr/sbin/ip6tables -t mangle -F
/usr/sbin/ip6tables -t mangle -X
/usr/sbin/ip6tables -t mangle -Z
/usr/sbin/ip6tables -t mangle -P PREROUTING ACCEPT
/usr/sbin/ip6tables -t mangle -P OUTPUT ACCEPT
/usr/sbin/ip6tables -t mangle -P INPUT ACCEPT
/usr/sbin/ip6tables -t mangle -P FORWARD ACCEPT
/usr/sbin/ip6tables -t mangle -P POSTROUTING ACCEPT
/usr/sbin/iptables -t nat -F
/usr/sbin/iptables -t nat -X
/usr/sbin/iptables -t nat -Z
/usr/sbin/iptables -t nat -P PREROUTING ACCEPT
/usr/sbin/iptables -t nat -P OUTPUT ACCEPT
/usr/sbin/iptables -t nat -P POSTROUTING ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 12443 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 12443 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 11443 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 11444 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 11443 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 11444 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 8447 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 8447 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 8443 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 8880 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 8443 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 8880 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 443 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 21 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 21 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 22 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 587 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 587 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 25 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 465 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 25 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 465 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 110 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 995 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 110 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 995 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 143 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 993 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 143 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 993 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 106 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 106 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 3306 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 5432 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 5432 -j ACCEPT

/usr/sbin/iptables -A INPUT -p tcp --dport 9008 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 9080 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 9008 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 9080 -j ACCEPT

/usr/sbin/iptables -A INPUT -p udp --dport 137 -j ACCEPT
/usr/sbin/iptables -A INPUT -p udp --dport 138 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 139 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 445 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p udp --dport 137 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p udp --dport 138 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 139 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 445 -j ACCEPT

/usr/sbin/iptables -A INPUT -p udp --dport 1194 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p udp --dport 1194 -j ACCEPT

/usr/sbin/iptables -A INPUT -p udp --dport 53 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 53 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p udp --dport 53 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p tcp --dport 53 -j ACCEPT

/usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 134/0 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 135/0 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 136/0 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 137/0 -j ACCEPT

/usr/sbin/iptables -A INPUT -p icmp --icmp-type 8/0 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 128/0 -j ACCEPT
/usr/sbin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 129/0 -j ACCEPT

/usr/sbin/iptables -A INPUT -j DROP
/usr/sbin/ip6tables -A INPUT -j DROP

/usr/sbin/iptables -A OUTPUT -j ACCEPT
/usr/sbin/ip6tables -A OUTPUT -j ACCEPT

/usr/sbin/iptables -A FORWARD -j DROP
/usr/sbin/ip6tables -A FORWARD -j DROP

echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /usr/local/psa/var/modules/firewall/ip_forward.active
chmod 644 /usr/local/psa/var/modules/firewall/ip_forward.active
#
# End of script
#