Bug 961345 - lokkit command deletes existing iptables entries
lokkit command deletes existing iptables entries
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: system-config-firewall (Show other bugs)
All Linux
unspecified Severity low
: rc
: ---
Assigned To: Thomas Woerner
Depends On:
  Show dependency treegraph
Reported: 2013-05-09 08:55 EDT by Nicola Asuni
Modified: 2013-05-10 05:11 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-05-10 05:11:53 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Nicola Asuni 2013-05-09 08:55:25 EDT
Description of problem:

When executing the "lokkit" command some existing entries on iptables are deleted.

Version-Release number of selected component (if applicable):

lokkit --version
system-config-firewall 1.2.27

uname -a
Linux testguest 2.6.32-358.6.1.el6.x86_64 #1 SMP Tue Apr 23 19:29:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

How reproducible:

Steps to Reproduce:

1. add the following entry to iptables:

iptables -t filter -I INPUT -m state --state NEW -m tcp -p tcp -s --dport 443 -j ACCEPT

2. save iptables:

service iptables save

3. check if the entry is correctly added:

iptables -L

4. execute a lokkit command:

lokkit -p 9940:tcp

5. now the previous iptable entry has been deleted. You can check with:

iptables -L

This is for me a severe bug since during automatic deployment the firewall configuration of numerous guests were corrupted.
Comment 1 Nicola Asuni 2013-05-09 08:56:45 EDT
Please note that I am currently using a fully updated CentOS version (as today).
Comment 3 Stephen John Smoogen 2013-05-09 13:29:46 EDT
Hi I am not the maintainer of this software but helped (in a very very small part) in its initial development.

The application is working as "intended". lokkit and by extension system-firewall-config is meant to be an initial firewall setup tool and was never meant to deal with existing or edited firewall tables. Any editing of existing rules requires complicated logic to guess the intention of the system administrator (like does the administrator really want to put the ALLOW rule after a DROP rule so it never gets there.. or vice versa.) 

Currently development for such a system is going on in the program firewalld which is meant to be more versatile in handling firewalls.
Comment 4 Nicola Asuni 2013-05-10 03:56:18 EDT
Hi Stephen, thank you for your prompt answer.

After further investigation I also realized that the two systems, iptables and lokkit, are incompatible but this was not immediately clear for me.

Initially I thought that using lokkit was an easy way to *add* an entry to the iptables file while, I discovered later, that when the lokkit command is invoked, the iptables files (/etc/sysconfig/iptables and /etc/sysconfig/ip6tables) are destroyed and rewritten using only the information on /etc/sysconfig/system-config-firewall file generated by lokkit.

As a future reference, the solution to my case consist into using the "--custom-rule" option of lokkit and write a custom file with the custom rule to add. For example:

echo "-I INPUT -m state --state NEW -m tcp -p tcp -s --dport 443 -j ACCEPT" > /etc/sysconfig/iptables-custom-rule

lokkit --custom-rules=ipv4:filter:/etc/sysconfig/iptables-custom-rule
Comment 5 Thomas Woerner 2013-05-10 05:11:53 EDT
I can not add more information to the comment from Stephen and also your own.

Closing as not a bug.

Note You need to log in before you can comment on or make changes to this bug.