Skip to content

iptables

How To Disable Firewalld and Get Old School IPTables Back In CentOS 7 and RHEL 7

When CentOS 7 was released, it was quickly obvious that CentOS and Red Hat had switched over to firewalld for its firewall control. Although its syntax is a bit easier to work with than iptables, some software out there has issues with it, such as Docker. Some just prefer to stick with the standard iptables syntax because it is what they know and what they are comfortable with. So, if you have CentOS 7 or RHEL 7 installed and want the old iptables back, this guide is for you.

First thing’s first, disable firewalld

#  systemctl mask firewalld

Now, lets stop firewalld

#  systemctl stop firewalld

It would be a good idea to go ahead and make sure that firewalld is masked and inactive, so lets do just that.

#  systemctl status firewalld

firewalld.service
   Loaded: masked (/dev/null)
   Active: inactive (dead)

Click Here to Read The Entire Tutorial!

MailCleaner Spam Filter – How To Open a Port & Add IPTables Firewall Rules

MailCleaner is a nice Open Source Linux distribution that creates a spam filter appliance. It is designed to sit in between an email server and the internet and filter spam out of email using advanced rules, DNS RBL (realtime black list), and many other techniques. It also scans email for viruses. Although I no longer use MailCleaner (I have replaced it with ScrollOut F1), I remember coming across a big issue in the past that took me some time to figure out, so I thought I would share it.

Because MailCleaner is more or less an appliance, most aspects of the operating system are controlled by MailCleaner. A majority of the settings you need to change are easily available on the web interface, however firewall rules are not. MailCleaner is designed so that it manages all IPTables rules. If you manually add an IPTables rule from the command line, once it’s reloaded or the system is reboot, the rule is gone. That is because MailCleaner wipes out and reloads IPTables rules from data stored in its MySQL database. So, in order to open any additional ports, you must modify the database. I encountered this dilemma when I installed a remote monitoring client (the Nagios based Check_MK to be exact), and needed to open a port to allow the monitoring server to connect.

Lets assume I need to open up SSH (port 22) and RSYNC (port 873) and I only want my mail server’s IP, 1.2.3.4, to connect. Normally we would enter the following iptables commands:

sudo iptables -A INPUT -s 1.2.3.4/32 -p tcp -m tcp --dport 873 -j ACCEPT
sudo iptables -A INPUT -s 1.2.3.4/32 -p tcp -m tcp --dport 22 -j ACCEPT

But in this case, we cannot. The good news is the MailCleaner will do it for you if you add the correct info into the MySQL database. Here’s how you do that (from a command prompt on the MailCleaner server):

Click Here To Read The Entire Tutorial!