4

I use RaspBMC as OS which stores its "persistent" iptables configuration in /etc/network/if-up.d/secure-rmc and I presume it's applied when the eth link goes up (e.g. after boot).

If I futz with the rules in the console, how can I reload the "persistent" ones (and discard the futz'd rules)?

There's no 'service' per se for iptables, and trying to service networking restart doesn't seem to help.

I've already locked myself out twice trying variations of ifconfig eth0 down; ifconfig eth0 up (a reboot helps :-) )

Improve this question
1
  • Hi Cristi: I have exactly your problem and it seems nobody really understood your question. In addition to your attempts, I tried to simply execute the script (sourcing, bash-ing...), but in any case it gives some error messages and the results is not at all the set of iptables rules that I see after a fresh reboot (which is, quite annoying, the only way to get what we want, AFAIK). So, my question: did you get any progress on the issue? Cheers.
    – hronir
    Jul 16, 2014 at 21:01

2 Answers 2

Reset to default
6

The iptables "rules" commands in secure-rmc are very simplistic:

logger -t iptables "Configuring ip tables for interface $IFACE"
if [ "$IFACE" != "lo" ]; then
    NETMASK=$(get_subnet $IFACE)
    iptables -A INPUT -s $NETMASK -i $IFACE -j ACCEPT
    iptables -A INPUT -i $IFACE -j DROP
fi

(get_subnet is a function that extracts the subnet of interface $IFACE using ifconfig)

These rules can be formulated as:

  • Accept any traffic from the local network on $IFACE.
  • Ignore all other incoming traffic from $IFACE.

I suggest you to utilise iptables-save and iptables-restore when playing with firewall rules. Have a look at their manual pages for more details.

Example:

iptables-save > iptables-original.rules
iptables -I INPUT 2 ...
# oops, fscked up, let's roll back to the original ruleset
iptables-restore < iptables-original.rules
Improve this answer
4
  • I have read about iptables-save & friends. I was hoping there was an easy way to just toggle the networking support off and back on. Just like a reboot, but... without a reboot :)
    – Cristian Diaconescu
    May 14, 2013 at 13:46
  • @CristiDiaconescu Bringing the network down and up can be down with ifconfig eth0 down; ifconfig eth0 up. Use iptables -nL to find your current rule set. iptables -F removes all rules, but keep in mind that the default policy of a chain may be set to DROP. If you still want to be able to accept external traffic, change the default policy for incoming packets to accept packets (if not already): iptables -P INPUT ACCEPT. Plenty of iptables manuals/guides out of here.
    – Lekensteyn
    May 14, 2013 at 13:52
  • I tried ifconfig eth0 down; ifconfig eth0 up over ssh (while away from the RasPi) and locked myself out...
    – Cristian Diaconescu
    May 16, 2013 at 9:08
  • @CristiDiaconescu Have you looked in your logs? It is normal that the connections freezes for some seconds. A static IP helps.
    – Lekensteyn
    May 16, 2013 at 19:46
5 
iptables -F
iptables -X

should do the trick of cleaning your current setup, or you may use the particular chain name you don't like:

iptables -F INPUT

I'd recommend to add these commands at the top of your script issuing iptables commands, so every time you start from a known situation.

Also, could you please elaborate more about what is your goal? the default setup seems quite reasonable and logical for a device on the local network.

ok, thanks for the clarification. you may revert your settings to the default with the:

iptables -A INPUT -s 192.168.1.0/24 -i $IFACE -j ACCEPT
iptables -A INPUT -i $IFACE -j DROP

just replace the network address with your real local network address and probably add the before mentioned commands to flush and delete your current chains. Playing with the network up/down scripts is a very proven way to lock yourself out of your Raspberry Pi =)

Improve this answer
4
  • The default setup won't allow connections from outside the LAN (e.g. SSH) even if the LAN gateway is set to forward the corresponding ports to the RasPi. Plus right now I'm playing with port knocking and it's an iterative process :)
    – Cristian Diaconescu
    May 14, 2013 at 13:11
  • Also: your answer only removes everything from the iptables' list of rules. That's not what I'm after. I want to revert to the rules that were in place when the system first booted - the rules specified in the script I mentioned in the question. But I'm not sure how to call the script directly (not sure what params it takes), so I figured that restarting the networking module would do that for me.
    – Cristian Diaconescu
    May 14, 2013 at 13:50
  • @CristiDiaconescu updated an answer
    – lenik
    May 14, 2013 at 15:32
  • @CristiDiaconescu You still need to replace 192.168.1.0/24 by the netmask (which does not have to be 192.168.1.0/24) and $IFACE by the interface name (usually eth0). Though I still suggest using iptables-save/iptables-restore to revert to a previous rule set, that also accounts for the default policy (should you change that with iptables -P).
    – Lekensteyn
    May 14, 2013 at 15:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.