Topic: Weird iptables issue (comes up wrong, restart 'fixes' it)
==== Required information ====
- iRedMail version (check /etc/iredmail-release):
- Linux/BSD distribution name and version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
======== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.7
- Linux/BSD distribution name and version: Ubuntu 16.04
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Apache
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
On a fresh boot of my VPS, I'm not getting access to the webserver (ie https://mydomain.com/mail, for example time out).
SSH access is fine.
On a clean boot, iptables -nL returns
root@server:~# iptables -nL
Chain INPUT (policy DROP)
target prot opt source destination
f2b-sshd-ddos tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 22
f2b-sogo tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
f2b-roundcube tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
f2b-postfix tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
f2b-dovecot tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
f2b-postfix tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
f2b-nginx tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443,25,587,110,995,143,993,4190
f2b-sshd tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 22
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:587
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:110
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:995
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:143
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:993
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain f2b-dovecot (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain f2b-nginx (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain f2b-postfix (2 references)
target prot opt source destination
REJECT all -- 71.200.137.146 0.0.0.0/0 reject-with icmp-port-unreachable
RETURN all -- 0.0.0.0/0 0.0.0.0/0
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain f2b-roundcube (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain f2b-sogo (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain f2b-sshd (1 references)
target prot opt source destination
REJECT all -- 59.45.175.98 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 59.45.175.97 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 59.45.175.95 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 221.194.47.236 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 221.194.47.233 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 221.194.44.212 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 121.18.238.125 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 121.18.238.123 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 121.18.238.106 0.0.0.0/0 reject-with icmp-port-unreachable
REJECT all -- 119.193.140.209 0.0.0.0/0 reject-with icmp-port-unreachable
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain f2b-sshd-ddos (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0
I'm not sure if this is right or wrong, but I'm blocked out of web access. If I run 'service iptables restart', my blocked access goes away, but seemingly so does fail2ban and all the items that make the server safer.
After running 'service iptables restart', 'iptables -nL' returns:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:587
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:110
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:995
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:143
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:993
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Any idea why I'm blocked out on boot with the default iptables and what I can do to correct this?
Andrew
----
Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.