When applying configuration in IPTABLES produces error, Firewall is reset (both active and boot)

I used Webmin/networking to modify the port number on an INPUT rule to a new value.

First, hit "Revert configuration" to make sure I had an copy of the active firewall. Modified the rule with the new port value and saved. Hit "Apply configuration" and it gave an error (did not write it down. I think it was from an iptables command.) Went back to the prior page to see what was going on.

At this point, ALL the firewall rules were gone. Hit "Revert configuration" again, and no rules came back. Went into a bash command line, to find that /etc/sysconfig/iptables was also reset to nothing.

This is not acceptable for such a critical feature. If you get an error applying an iptables configuration, it should just revert to the old configuration, not wipe out the active and boot firewalls. It took me days to rebuilt the firewall from memory.

I would also recommend that prior to an "apply configuration," you should save a backup somewhere, perhaps /etc/sysconfig/iptables.backup just in case.

Status: 
Active

Comments

That seems like a bug - it's possible that because the Apply failed, the active rules were now empty, and then clicking Revert copies the active set to the config file.

Is there a reason you're frequently using Revert/Apply though? Normally the list from the config file is considered canonical, and only copied to the active set (and not the other way around).

bperet's picture
Submitted by bperet on Mon, 06/24/2019 - 09:56

I use fail-to-ban, which modifies the active firewall. If you've used it, you know it has some idiosyncrasies like not always shutting down properly and leaving stuff in the active firewall. I got into the habit of using "revert" to see if it cleared out correctly, otherwise you can end up with missing or duplicate f2b entries in the iptables file.

I did not realize that "revert" copied the active set to the config file. I thought it just brought the active copy to the webmin screen, and you had to "apply" before it saved to the file.