Red Hat Bugzilla – Bug 961345
lokkit command deletes existing iptables entries
Last modified: 2013-05-10 05:11:53 EDT
Description of problem:
When executing the "lokkit" command some existing entries on iptables are deleted.
Version-Release number of selected component (if applicable):
Linux testguest 2.6.32-358.6.1.el6.x86_64 #1 SMP Tue Apr 23 19:29:00 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
Steps to Reproduce:
1. add the following entry to iptables:
iptables -t filter -I INPUT -m state --state NEW -m tcp -p tcp -s 10.199.3.16 --dport 443 -j ACCEPT
2. save iptables:
service iptables save
3. check if the entry is correctly added:
4. execute a lokkit command:
lokkit -p 9940:tcp
5. now the previous iptable entry has been deleted. You can check with:
This is for me a severe bug since during automatic deployment the firewall configuration of numerous guests were corrupted.
Please note that I am currently using a fully updated CentOS version (as today).
Hi I am not the maintainer of this software but helped (in a very very small part) in its initial development.
The application is working as "intended". lokkit and by extension system-firewall-config is meant to be an initial firewall setup tool and was never meant to deal with existing or edited firewall tables. Any editing of existing rules requires complicated logic to guess the intention of the system administrator (like does the administrator really want to put the ALLOW rule after a DROP rule so it never gets there.. or vice versa.)
Currently development for such a system is going on in the program firewalld which is meant to be more versatile in handling firewalls.
Hi Stephen, thank you for your prompt answer.
After further investigation I also realized that the two systems, iptables and lokkit, are incompatible but this was not immediately clear for me.
Initially I thought that using lokkit was an easy way to *add* an entry to the iptables file while, I discovered later, that when the lokkit command is invoked, the iptables files (/etc/sysconfig/iptables and /etc/sysconfig/ip6tables) are destroyed and rewritten using only the information on /etc/sysconfig/system-config-firewall file generated by lokkit.
As a future reference, the solution to my case consist into using the "--custom-rule" option of lokkit and write a custom file with the custom rule to add. For example:
echo "-I INPUT -m state --state NEW -m tcp -p tcp -s 10.199.3.16 --dport 443 -j ACCEPT" > /etc/sysconfig/iptables-custom-rule
I can not add more information to the comment from Stephen and also your own.
Closing as not a bug.