生半可なく書き間違えて、失敗しても猛スピードで忘れるので記録していく。
事象 : Applying firewall rules: iptables-restore
$ sudo service iptables restart
iptables: Setting chains to policy ACCEPT: nat [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: iptables-restore: line 9 failed
[FAILED]
原因 : パケット転送の設定を*natじゃなくて*filterに書いてしまった
- 環境
- CentOS release 6.9 (Final)
- iptables v1.4.7
$ sudo cat /etc/sysconfig/iptables
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp --dport 10080 -j DNAT --to-destination 10.0.1.2:80
-A POSTROUTING -d 10.0.1.2/32 -p tcp -m tcp --dport 80 -j SNAT --to-source 10.0.1.3
...省略...
- 対応 : パケット転送の設定を*natに書く
事象 : Applying firewall rules: iptables-restore v1.x.x: Can’t set policy INPUT' on ACCEPT'
$ sudo service iptables restart
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: iptables-restore v1.4.7: Can’t set policy `INPUT' on `ACCEPT' line 5: Bad built-in chain name
[FAILED]
原因1 : INPUTが*natに書いてあるから
- 環境
- CentOS release 6.9 (Final)
- iptables v1.4.7
INPUTはfilterとmagnleに設定するもの
$ sudo cat /etc/sysconfig/iptables
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
...省略...
- 対応 : 「:INPUT ACCEPT [0:0]」を削除する
事象 : Applying firewall rules: Bad argument
$ sudo service iptables restart
iptables: Setting chains to policy ACCEPT: nat [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: Bad argument `*filter'
Error occurred at line: 10
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
原因1 : 「COMMIT」を書いていないから
- 環境
- CentOS release 6.9 (Final)
- iptables v1.4.7
$ sudo cat /etc/sysconfig/iptables
*nat
...省略...
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
- 対応 : *filterの最後に「COMMIT」を追記する
事象 : Applying firewall rules: iptables-restore v1.4.18: invalid port/service `68081' specified
- 環境
- Amazon Linux AMI release 2017.09
- iptables v1.4.18
$ sudo service iptables restart
iptables: Flushing firewall rules: [ OK ]
iptables: Setting chains to policy ACCEPT: filter nat [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: iptables-restore v1.4.18: invalid port/service `68081' specified
Error occurred at line: 57
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
原因 : ポート番号の枠(～65535)を超えたから？
ポート番号の枠は 0 ～ 65535 ですが、ポート番号には以下の3つの種類があります。
TCP/UDPポート番号一覧
既存の設定と被らないようにどんどんポート番号をでかくしてしまった・・・。
$ sudo cat /etc/sysconfig/iptables | grep 68081
-A PREROUTING -p tcp -m tcp --dport 68081 -j DNAT --to-destination 10.0.0.221:8081
Port numbers are assigned in various ways, based on three ranges: System Ports (0-1023), User Ports (1024-49151), and the Dynamic and/or Private Ports (49152-65535); the difference uses of these ranges is described in [RFC6335].
Service Name and Transport Protocol Port Number Registry
- 対応 : 65535以下のポート番号に変更する