[BUG] netfilter-persistent.service error

Community Support Firewall
1

Hi,

Just to report a bug and fix.

If you have custom IPSet (e.g. from a URL) setting up with HCP and also applied to one of the rule, at the same time altering iptables manually for other purpose and save the iptables with iptables-persistent package.

When you restart the server, iptables may not be able to restore properly and stating error reading the IPv4, IPv6 file at the line you’ve setup custom rule with IPSets.

Problem root cause:

netfilter-persistent.service is loaded BEFORE hestia-iptables.service which makes netfilter-persistent.service didn’t get the IPSet from Hestia, then it will report error and stop processing the restore

Resolution:

as per @sahsanu

2

You can add your own rules in the file /usr/local/hestia/data/firewall/custom.sh (the file is a script and must have executable permissions) and Hestia will execute that script when updating firewall, just a quick example.

❯ cat /usr/local/hestia/data/firewall/custom.sh
#!/usr/bin/env bash
ipt="/usr/sbin/iptables"
ipt6="/usr/sbin/ip6tables"

"$ipt6" -P INPUT DROP
"$ipt6" -A INPUT -s ::1 -j ACCEPT
"$ipt6" -A OUTPUT -d ::1 -j ACCEPT
"$ipt6" -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
"$ipt6" -A INPUT -p icmpv6 -j ACCEPT

ipset="i5 portspoof sahsanu-LV1 sahsanu-LV2 sahsanu-LV3 permaban"
chain_prefix="LOG_DROP"
action="DROP"
for i in $ipset; do
    "$ipt" -F "$chain_prefix"_"$i"
    "$ipt" -X "$chain_prefix"_"$i"
    "$ipt" -N "$chain_prefix"_"$i"
    "$ipt" -A "$chain_prefix"_"$i" -j LOG --log-level 4 --log-prefix "iptables:drop:$i "
    "$ipt" -A "$chain_prefix"_"$i" -j "$action"
    "$ipt" -I INPUT -m set --match-set "$i" src -j "$chain_prefix"_"$i"
done
[...]
1 Like
3

Guys, please follow Sahsanu’s advice as my previous solution will mess up the firewall rules setup by Hestia Firewall settings. (Reason: the HestiaCP firewall will be overwritten by rules saved at netfilter-persistent)

6

@sahsanu

I’ve figured out to use custom.sh to add iptables rules. But is it possible for that script to make sure of ipset from HestiaCP (/usr/local/hestia/data/firewall/ipset)? I would like to make use of that for GeoIP blocking/allowing as well

Thanks

7

Sorry, I don’t know what you mean. Could you please explain it a bit more?

8

I’ve created some IPset from HestiaCP which sort out my country IP list, and the list were using by some of my rules set at HestiaCP itself. But can I use those list for my custom iptables rules set at custom.sh as well?

9

Yes, you can. Those ipsets are created by Hestia but are available system-wide.

10

May I know how to use it? for example I have an IPSet named “HongKong“

How can I put in to this rule?

$IPTABLES -I DOCKER-USER -p tcp XXXXXX --dport 9443 -j ACCEPT
11 
$IPTABLES -I DOCKER-USER -p tcp -m set --match-set HongKong src --dport 9443 -j ACCEPT
1 Like
12

Cool, thanks so much, so I don’t need to use xt_geoip module anymore, cool

13

Do I need to add module “-m tcp” as well? ( i saw that from /etc/iptables.rules files

Like this?

$IPTABLES -I DOCKER-USER -p tcp -m tcp --dport 9443 -m set --match-set HongKong src -j ACCEPT
14

No, -p tcp already loads the tcp module but it won’t hurt if you add it.

1 Like