On a clean install of rpi3, iptables was not initialized after runansible

[georgejhunt]

history:
../runansible
reboot
(maybe should not expect proper function until console "install configured options" has run once

[tim-moody]

runansible should leave a working install without anything else being done.

what was the network mode? iptables has no rules on reboot?

[tim-moody]

another data point in case relevant. after ansible through console with squid off, gateway passthru off, service from wan on I get:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 111 -j DROP
-A INPUT -p udp -m udp --dport 111 -j DROP
-A INPUT -p tcp -m tcp --dport 3306 -j DROP
-A INPUT -p udp -m udp --dport 3306 -j DROP
-A INPUT -p tcp -m tcp --dport 5432 -j DROP
-A INPUT -p udp -m udp --dport 5432 -j DROP
-A INPUT -p tcp -m tcp --dport 5984 -j DROP
-A INPUT -p udp -m udp --dport 5984 -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i br0 -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --dport 5353 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 3000 -m state --state NEW -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 8008 -m state --state NEW -j ACCEPT
-A INPUT -i eth0 -j DROP
-A FORWARD -i eth0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i br0 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -o br0 -j DROP
root@rpi-demo:~# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT

[jvonau]

Those rules look correct. Is the debain package iptables-persistant (think that is the nane) installed? http://unix.stackexchange.com/questions/52376/why-do-iptables-rules-disappear-when-restarting-my-debian-system Sent from Samsung MobileTim Moody <[email protected]> wrote:another data point in case relevant. after ansible through console with squid off, gateway passthru off, service from wan on I get:

…

-P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 111 -j DROP -A INPUT -p udp -m udp --dport 111 -j DROP -A INPUT -p tcp -m tcp --dport 3306 -j DROP -A INPUT -p udp -m udp --dport 3306 -j DROP -A INPUT -p tcp -m tcp --dport 5432 -j DROP -A INPUT -p udp -m udp --dport 5432 -j DROP -A INPUT -p tcp -m tcp --dport 5984 -j DROP -A INPUT -p udp -m udp --dport 5984 -j DROP -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i br0 -m state --state NEW -j ACCEPT -A INPUT -p udp -m udp --dport 5353 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 3000 -m state --state NEW -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp --dport 8008 -m state --state NEW -j ACCEPT -A INPUT -i eth0 -j DROP -A FORWARD -i eth0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i br0 -o eth0 -j ACCEPT -A FORWARD -i eth0 -o br0 -j DROP root@rpi-demo:~# iptables -t nat -S -P PREROUTING ACCEPT -P INPUT ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.