group iptables rules in chain

When managing multiple firewall rules for a specific application, service, or policy, adding them directly to default chains (like INPUT, FORWARD, or PREROUTING) makes bulk updates and cleanups difficult. If you need to remove or disable that policy later, you would normally have to delete every single rule one by one.

The cleanest solution in iptables is to create a custom user-defined chain. By grouping related rules inside their own chain and linking that chain to a default table, you can enable, disable, or flush all associated rules in a single command.

---

The Problem: Cluttered Default Chains

Consider applying several packet-marking or filtering rules for a specific service across different hooks:

iptables -t mangle -A PREROUTING -p udp --dport 4444 -j MARK --set-mark 100
iptables -t mangle -A INPUT -p udp --dport 4444 -j MARK --set-mark 100
iptables -t mangle -A OUTPUT -p udp --dport 4444 -j MARK --set-mark 200

Deleting these later requires referencing each specific rule line or rule number individually, which is tedious and error-prone in production environments.

---

The Solution: Group Rules into a Custom Chain

Step 1: Create the Custom Chain in the Target Table

Create a custom chain (e.g., MYCHAIN). Remember that user-defined chains exist only within the specific table where they are created (e.g., mangle, filter, or nat):

# Create MYCHAIN inside the mangle table
iptables -t mangle -N MYCHAIN

Step 2: Add Rules into Your Custom Chain

Populate your chain with the relevant match criteria and actions:

iptables -t mangle -A MYCHAIN -p udp --dport 4444 -j MARK --set-mark 100
iptables -t mangle -A MYCHAIN -p udp --sport 4444 -j MARK --set-mark 200

Step 3: Link Your Custom Chain to Built-in Chains

To make the rules active, direct traffic from the standard hooks (such as PREROUTING or INPUT) into your custom chain:

iptables -t mangle -A PREROUTING -j MYCHAIN
iptables -t mangle -A OUTPUT -j MYCHAIN

---

How to Easily Manage and Delete the Group

When you need to clear or completely remove the rule group, the workflow is clean and immediate:

1. Unlink the Chain: Remove the single jump rule from the built-in chains:

   iptables -t mangle -D PREROUTING -j MYCHAIN
   iptables -t mangle -D OUTPUT -j MYCHAIN

2. Flush the Rules: Clear all rules inside your custom chain in one step:

   iptables -t mangle -F MYCHAIN

3. Delete the Empty Chain: Remove the custom chain definition:

   iptables -t mangle -X MYCHAIN

configure logrotate to not delete log files after rotation

copy: Make a copy of the log file, but don’t change the original at all.
copytruncate: Truncate the original log file in place after creating a copy.

An example: /etc/logrotate.d/mds

/var/log/mds/mds-app-*.log {
    daily
    copytruncate
    rotate 30
    dateext
    missingok
    notifempty
    sharedscripts
}

How to block incoming Russian IP addresses in the iptables by user defined chain

Too much attack/scanning to the server. Try to block all incoming Russian IP addresses in the iptables.

1. First find generate the ACL list from:
https://www.countryipblocks.net/acl.php It gives me a total # of 24,445 line of ip address range at the time.
2. Replace the iptables string for user-defined chain:

iptables

by

iptables -A chain-Russian-Block



Run the command to make create the chain:

iptables -N chain-Russian-Block
...
iptables -A chain-Russian-Block -s 2.56.24.0/23 -j DROP
iptables -A chain-Russian-Block -s 2.56.26.0/23 -j DROP
iptables -A chain-Russian-Block -s 2.56.88.0/22 -j DROP
...
iptables -A INPUT -j chain-Russian-Block

Check total lines of rules in the chain:

# iptables -S chain-Russian-Block | wc -l
24,445

Save it for reboot.

service netfilter-persistent save

VMware vSphere Hypervisor ESXi Intel NUC homelab service settings

I checked the services configuration and turn off these services ffter re-build homelab ESXi on Intel NUC: lbtd: Load-Based Teaming Daemon Only 1 NIC on NUC ( I disabled wifi from NUC BIOS ).

vpxa: VMware vCenter Agent I do not connect my ESXi to any vCenter.

slpd: Skyline Health Diagnostics CIM Server NUC does not support it. And skip the CIM security issue.

TSM-SSH: ssh service.

Have a nice day.

How to reset check_mk admin password

My Windows 10 Laptop just crashed after latest Intel patch upgrade.

Forgot to save the admin password on one of the latest check_mk site I built.

su - mysite

cd etc

ls -l htpasswd

OMD[mysite]:~/etc$ ls -l htpasswd

Example: check_mk version 1.4:

lambert:!$1$042926$lmAEb.P5TAi0sZfiGyWHX.
omdadmin:M29dfyFjgy5iA

check_mk version 1.5:

automation:$1$857531$PzhNz/zMdQv8xGu68EZhD.
cmkadmin:$1$386620$Xe5mZKwrPRlzx0BvZCJM8.

htpasswd htpasswd omdadmin          # set password for user *omdadmin*

New password: 

Re-type new password:

You should be good! Have a nice day!

CentOS 7 How to secure SSH service

Haven't got any time play with CentOS 7 since it launched.

Here are my steps to setup the SSH service on CentOS 7:

1.sudo

2.Configure SSH disable root remote login

vi /etc/ssh/sshd_config

PermitRootLogin no

3.Configure SSH to a bigger random port
Most of the "Port scanning Tools", start from lower ports number: 1,2,3...20,21,22,23...10000.
To make "My Friends"'s work a little bit hard.
To secure the ssh, simply give it an high random number like: 44022

vi /etc/ssh/sshd_config

Port 44022

4.Tell SELinux to pickup the new port

semanage port -a -t ssh_port_t -p tcp 44022

5.Update Firmwalld allow the new port

vi /usr/lib/firewalld/services/ssh.xml

  SSH
  Secure Shell (SSH) is a protocol for logging into and executing commands on remote machines. It provides secure encrypted communications. If you plan on accessing your machine remotely via SSH over a firewalled interface, enable this option. You need the openssh-server package installed for this option to be useful.
  

Now restart the ssh and firmwalld daemons

# systemctl restart sshd.service
# firewall-cmd --reload

Reference: http://wiki.centos.org/HowTos/Network/SecuringSSH

[poll id="3"]

How to protect your web site by iptables on CentOS RHEL OEL

# Fist Cleaning all rules
iptables -F
iptables -X

# By default I drop all traffic
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Only allow ssh and web
iptables -A INPUT -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -m tcp -p tcp --sport 22 -j ACCEPT
iptables -A OUTPUT -m tcp -p tcp --sport 80 -j ACCEPT

# Allow lo
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Save the config for reboot and restart the service see how it works.
service iptables save
service iptables restart

More safe if you have a static IP:

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -s [My Static IP]/32 -d [Server IP]/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s [Server IP]/32 -d [My Static IP]/32 -p tcp -m tcp --sport 22 -j ACCEPT

More safe if you Only talk to another server:

-A INPUT -s [Another Server]/32 -p tcp -m tcp --sport 80 -j ACCEPT
-A OUTPUT -d [Another Server]/32 -p tcp -m tcp --dport 80 -j ACCEPT

If you want allow ssh from other subnet:

-A INPUT -s 192.168.244.0/24 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A OUTPUT -d 192.168.244.0/24 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT

Enable DNS:

iptables -A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
iptables -A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT

Enable yum:

iptables -A OUTPUT -m tcp -p tcp -m state --state NEW -m multiport --dports 80,443 -j ACCEPT