Posted: Wed Nov 02, 2022 21:33 Post subject: [SOLVED] Rules in Firewall commands are duplicated
Router: Netgear R7000
Firmware: v3.0-r50308
Kernel: Linux 4.4.302
I have a few rules set in my Firewall commands. These all work as expected, but when I ran
Code:
iptables -L FORWARD -v -n --line-numbers
I noticed that all the rules I implemented are duplicated. After rebooting the router, the duplicated rules persist.
When I empty the list of rules and add them one-by-one, I don't see any duplicated rules. As soon as I put all these rules in the Firewall commands and reboot, the iptables get doubly populated again. It seems like somehow the router is running through this list of commands twice.
Although this is not necessarily a problem because connecting works as expected, it makes reading the iptables more difficult and I'd rather fix this before it becomes a problem.
Here is the output of the above iptables command. Note the duplicate rules for line 1-9 and 10-18. Interestingly, rules 16 and 17 (those allowing communication between vlans and wan) have caught some traffic, although rules 7 and 8 above are exactly the same.
Joined: 26 Mar 2013 Posts: 1857 Location: Hung Hom, Hong Kong
Posted: Thu Nov 03, 2022 11:24 Post subject: Re: [SOLVED] Rules in Firewall commands are duplicated
Encephala wrote:
Although this is not necessarily a problem because connecting works as expected, it makes reading the iptables more difficult and I'd rather fix this before it becomes a problem.
Here is the output of the above iptables command. Note the duplicate rules for line 1-9 and 10-18. Interestingly, rules 16 and 17 (those allowing communication between vlans and wan) have caught some traffic, although rules 7 and 8 above are exactly the same.
The firewall script is always started multiple times, sometimes 2 instances running at the same time! That might explain duplicates.
You might consider moving your custom iptables rules to the startup script, which is always executed once after the firewall script.
_________________ Router: Asus RT-N18U (rev. A1)
Drink, Blink, Stretch! Live long and prosper! May the Force and farces be with you!
this is a very bad idea
The firewall is executed after startup and overwrites firewall rules in startup
that's why we moved all the rules to the firewall a long time ago
Joined: 26 Mar 2013 Posts: 1857 Location: Hung Hom, Hong Kong
Posted: Thu Nov 03, 2022 12:34 Post subject:
ho1Aetoo wrote:
this is a very bad idea
The firewall is executed after startup and overwrites firewall rules in startup
that's why we moved all the rules to the firewall a long time ago
Well, if startup script was not the right place, then fall back further to USB script. My suggestion was to prevent multiple instances of the firewall script.
I assumed that you were calling the iptables command to add rules, not using iptables-save and iptables-restore.
_________________ Router: Asus RT-N18U (rev. A1)
Drink, Blink, Stretch! Live long and prosper! May the Force and farces be with you!
Joined: 31 Jul 2021 Posts: 2146 Location: All over YOUR webs
Posted: Thu Nov 03, 2022 13:45 Post subject:
startup script is a terrible place for these, because soon as you configure something in UI and click apply all services restart and what is startup is ignored.
Joined: 26 Mar 2013 Posts: 1857 Location: Hung Hom, Hong Kong
Posted: Fri Nov 04, 2022 10:18 Post subject:
ho1Aetoo wrote:
this is a very bad idea
The firewall is executed after startup and overwrites firewall rules in startup
that's why we moved all the rules to the firewall a long time ago
Today I did a trace of the repeated /tmp/.rc_firewall execution using PID and found that they had never overlapped with each other.
Code:
:~# grep changmw /var/log/messages
Jan 1 08:00:19 rt-n18u user.notice root: changmw: starting /tmp/.rc_firewall (1022)
Jan 1 08:00:20 rt-n18u user.notice root: : changmw exiting /tmp/.rc_firewall (1022)
Jan 1 08:00:29 rt-n18u user.notice root: changmw: starting /tmp/.rc_firewall (1671)
Jan 1 08:00:30 rt-n18u user.notice root: : changmw exiting /tmp/.rc_firewall (1671)
Nov 4 18:14:29 rt-n18u user.notice inadyn[1954]: Update forced for alias changmw.ddns.net, new IP# 110.235.6.142
Nov 4 18:14:30 rt-n18u user.notice inadyn[1954]: Updating cache for changmw.ddns.net
Nov 4 18:14:31 rt-n18u user.notice root: changmw: starting /tmp/.rc_firewall (2317)
Nov 4 18:14:32 rt-n18u user.notice root: : changmw exiting /tmp/.rc_firewall (2317)
Nov 4 18:14:36 rt-n18u user.notice root: changmw: starting /tmp/.rc_startup (2789)
Nov 4 18:14:37 rt-n18u user.notice root: : changmw exiting /tmp/.rc_startup (2789)
Nov 4 18:14:40 rt-n18u user.notice root: changmw: starting /tmp/.rc_usb
Nov 4 18:14:40 rt-n18u user.notice root: changmw: starting /tmp/.rc_usb
Nov 4 18:14:40 rt-n18u user.notice root: changmw: .rc_usb already started
Nov 4 18:14:42 rt-n18u user.notice root: : changmw exiting /tmp/.rc_usb
Modified the scripts and tried again. This time the startup script overlapped with USB script. Firewall script execution still had no overlap.
Code:
Jan 1 08:00:19 rt-n18u user.notice root: changmw[1018]: starting /tmp/.rc_firewall
Jan 1 08:00:20 rt-n18u user.notice root: changmw[1018]: exiting /tmp/.rc_firewall
Jan 1 08:00:29 rt-n18u user.notice root: changmw[1627]: starting /tmp/.rc_firewall
Jan 1 08:00:30 rt-n18u user.notice root: changmw[1627]: exiting /tmp/.rc_firewall
Nov 4 19:51:34 rt-n18u user.warn inadyn[2025]: Failed resolving hostname changmw.ddns.net: Try again
Nov 4 19:51:35 rt-n18u user.notice inadyn[2025]: Update forced for alias changmw.ddns.net, new IP# 110.235.6.142
Nov 4 19:51:38 rt-n18u user.notice root: changmw[2671]: starting /tmp/.rc_firewall
Nov 4 19:51:39 rt-n18u user.notice inadyn[2025]: Updating cache for changmw.ddns.net
Nov 4 19:51:39 rt-n18u user.notice root: changmw[2671]: exiting /tmp/.rc_firewall
Nov 4 19:51:45 rt-n18u user.notice root: changmw[3305]: starting /tmp/.rc_startup
Nov 4 19:51:46 rt-n18u user.notice root: changmw: starting /tmp/.rc_usb
Nov 4 19:51:46 rt-n18u user.notice root: changmw: starting /tmp/.rc_usb
Nov 4 19:51:46 rt-n18u user.notice root: changmw: .rc_usb already started
Nov 4 19:51:46 rt-n18u user.notice root: changmw[3305]: exiting /tmp/.rc_startup
_________________ Router: Asus RT-N18U (rev. A1)
Drink, Blink, Stretch! Live long and prosper! May the Force and farces be with you!
