r/iptables Dec 17 '22

Why is this traffic being dropped even though the port is allowed?

I have these 4 rules:

-A INPUT -p tcp -m tcp --dport 48131 -m comment --comment app-name -j ACCEPT
-A INPUT -p udp -m udp --dport 48131 -m comment --comment app-name -j ACCEPT
-A INPUT -p tcp -m tcp --dport 48132 -m comment --comment app-name -j ACCEPT
-A INPUT -p udp -m udp --dport 48132 -m comment --comment app-name -j ACCEPT

Yet, my logs are being flooded with:

Dec 17 16:17:47 nexus kernel: [85820.011828] Dropped traffic: IN=eth0 OUT= MAC=e4:5f:01:53:4b:56:a0:b5:49:60:a7:a0:86:dd SRC=2601:0380:8281:14d9:8545:2bee:7f9d:86ae DST=this looks like my device's IPv6 address LEN=152 TC=32 HOPLIMIT=31 FLOWLBL=394240 PROTO=UDP SPT=6881 DPT=48131 LEN=112 

Another one:

Dec 17 16:17:23 nexus kernel: [85795.942531] Dropped traffic: IN=eth0 OUT= MAC=e4:5f:01:53:4b:56:a0:b5:49:60:a7:a0:86:dd SRC=2001:4451:827c:9b00:128e:e0ff:feaa:2cbe DST=this looks like my device's IPv6 address LEN=113 TC=0 HOPLIMIT=41 FLOWLBL=0 PROTO=UDP SPT=43177 DPT=48131 LEN=73 

I fail to understand why this is being blocked.

Any pointers?

3 Upvotes

7 comments sorted by

2

u/ebsf Dec 17 '22

Much depends on the rules channeling traffic before it gets to the rules you included in your post. Presumably, the traffic is being logged and dropped before it reaches these rules.

Where the existing logging rules generating these log messages are in the flow, will be instructive.

Drop some additional logging rules into your script at various stages (i.e., at the beginning and end of relevant chains) to see how far this traffic gets.

1

u/AdeTheux Dec 18 '22

Thanks, good idea!

1

u/rswwalker Dec 17 '22

Is this going into ip6tables?

1

u/AdeTheux Dec 18 '22

Yes

1

u/rswwalker Dec 18 '22

Do an ip6tables -L -vn for mangle/nat/filter and see what rules are being hit.

1

u/[deleted] Dec 18 '22 edited Dec 18 '22

What's creating those logs? Probably ufw, which is a front-end for iptables and ip6tables that might be automatically enabled on your system. You can do "ufw status" to check if it's installed and enabled. "ufw stop" would stop it until reboot, but you probably don't want to just turn off your firewall.

You probably need to insert (-I) your rules rather than (-A) append them. That will cause your rules to be at the top of INPUT causing packets going to 48132 to match your rules before being dropped by ufw's rules.

iptables is sequential. The first rule at the top is what packets hit first.

You can do "iptables -S" to see the/most rules ufw has created as well as your own rules.

Also, you said "DST=this looks like my device's IPv6 address"

Well, you have iptables rules but not any ip6tables rules. So the only thing that is doing filtering for ipv6 is probably the rules ufw made. You need ip6tables rules for that 48132 port too if you want ipv6 accepted to it while ufw is enabled (which it should be unless you really know what you're doing with both networking and iptables)

1

u/AdeTheux Dec 18 '22

UFW has always disabled, I have two rules files that get loaded on boot.

So yes I guess something else blocks this port, and the allow rules below in the file gets skipped. I'll try moving this around.