RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 961345 - lokkit command deletes existing iptables entries
Summary: lokkit command deletes existing iptables entries
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: system-config-firewall
Version: 6.4
Hardware: All
OS: Linux
unspecified
low
Target Milestone: rc
: ---
Assignee: Thomas Woerner
QA Contact: qe-baseos-daemons
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-05-09 12:55 UTC by Nicola Asuni
Modified: 2013-05-10 09:11 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-05-10 09:11:53 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Nicola Asuni 2013-05-09 12:55:25 UTC 
Description of problem:

When executing the "lokkit" command some existing entries on iptables are deleted.

Version-Release number of selected component (if applicable):

lokkit --version
system-config-firewall 1.2.27

uname -a
Linux testguest 2.6.32-358.6.1.el6.x86_64 #1 SMP Tue Apr 23 19:29:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux



How reproducible:

Steps to Reproduce:

1. add the following entry to iptables:

iptables -t filter -I INPUT -m state --state NEW -m tcp -p tcp -s 10.199.3.16 --dport 443 -j ACCEPT

2. save iptables:

service iptables save

3. check if the entry is correctly added:

iptables -L

4. execute a lokkit command:

lokkit -p 9940:tcp

5. now the previous iptable entry has been deleted. You can check with:

iptables -L


This is for me a severe bug since during automatic deployment the firewall configuration of numerous guests were corrupted.
Comment 1 Nicola Asuni 2013-05-09 12:56:45 UTC 
Please note that I am currently using a fully updated CentOS version (as today).
Comment 3 Stephen John Smoogen 2013-05-09 17:29:46 UTC 
Hi I am not the maintainer of this software but helped (in a very very small part) in its initial development.

The application is working as "intended". lokkit and by extension system-firewall-config is meant to be an initial firewall setup tool and was never meant to deal with existing or edited firewall tables. Any editing of existing rules requires complicated logic to guess the intention of the system administrator (like does the administrator really want to put the ALLOW rule after a DROP rule so it never gets there.. or vice versa.) 

Currently development for such a system is going on in the program firewalld which is meant to be more versatile in handling firewalls.
Comment 4 Nicola Asuni 2013-05-10 07:56:18 UTC 
Hi Stephen, thank you for your prompt answer.

After further investigation I also realized that the two systems, iptables and lokkit, are incompatible but this was not immediately clear for me.

Initially I thought that using lokkit was an easy way to *add* an entry to the iptables file while, I discovered later, that when the lokkit command is invoked, the iptables files (/etc/sysconfig/iptables and /etc/sysconfig/ip6tables) are destroyed and rewritten using only the information on /etc/sysconfig/system-config-firewall file generated by lokkit.

As a future reference, the solution to my case consist into using the "--custom-rule" option of lokkit and write a custom file with the custom rule to add. For example:

echo "-I INPUT -m state --state NEW -m tcp -p tcp -s 10.199.3.16 --dport 443 -j ACCEPT" > /etc/sysconfig/iptables-custom-rule

lokkit --custom-rules=ipv4:filter:/etc/sysconfig/iptables-custom-rule
Comment 5 Thomas Woerner 2013-05-10 09:11:53 UTC 
I can not add more information to the comment from Stephen and also your own.

Closing as not a bug.
Note You need to log in before you can comment on or make changes to this bug.