htrgouvea/nipe

Conflicting iptables rules

Open

#88 opened on Jan 24, 2020

View on GitHub
 (2 comments) (2 reactions) (2 assignees)Perl (2,329 stars) (335 forks)batch import
help wantedrecommendation

Description

It seems some startup services may add conflicting rules to the system against Nipe:

$ ./nipe.pl start
...
$ ./nipe.pl status
[!] ERROR: sorry, it was not possible to establish a connection to the server.
$ curl https://check.torproject.org/api/ip
curl: (6) Could not resolve host: check.torproject.org

A solution I found was to completely flush iptables rules before nipe set its own rules:

$ ./nipe.pl stop
# iptables -F
$ ./nipe.pl start
...
$ curl https://check.torproject.org/api/ip
{"IsTor":true,"IP":"46.165.245.154"}
$ ./nipe.pl status
[+] Status: activated. 
[+] Ip: 87.118.116.103

One problem with this solution is the possible future conflicts we may have against other apps on the system. I'm don't really know how iptables works, so any help is welcome!

Contributor guide

Tech stack
None
Domain
security
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
blocked
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
basic iptables knowledgeLinux networking fundamentals
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
30
Research direction
Investigate the iptables rules set by nipe.pl in the 'start' subroutine (likely in lib/Nipe.pm or similar). Identify which system services or startup scripts may add conflicting rules. Consider implementing a check before setting rules to avoid conflicts, or flush only specific chains. Review any comments in the issue for additional context.