# Firewall is blocking all **URL:** \ **Category:** SLES Configure-Administer\ **Created:** [May 31, 2013, 4:37pm UTC](https://forums.suse.com/t/firewall-is-blocking-all/24021 "2013-05-31T16:37:23Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![g\_hammer](https://avatars.discourse-cdn.com/v4/letter/g/67e7ee/32.png) [@g\_hammer](https://forums.suse.com/u/g_hammer)\ **Post date:** [May 31, 2013, 4:37pm UTC](https://forums.suse.com/t/firewall-is-blocking-all/24021/1 "2013-05-31T16:37:23Z")
Hi, after changing name and IP-Address, the firewall is blocking all requests after rebooting. I even cannot ping the machine and I cannot stop the firewall. If I reboot the machine with disabled firewall and start it manually it works as expected. Can anybody help me with this problem? It is SLES 11 SP2. Best regards Gerlinde Hammer ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [May 31, 2013, 5:21pm UTC](https://forums.suse.com/t/firewall-is-blocking-all/24021/2 "2013-05-31T17:21:17Z")
Normally the firewall will not block ICMP echo requests at all, and while you can implement that the few places I’ve seen block them have done so using sysctl, as I recall. Anyway, as a result I do not believe the firewall is involved, but there are more things to check. First, do you have the old IP/netmask/gateway documented? If so, please share them. Second, please post the output from the following commands: ## Code: ## ip addr ip route Next, please post output from the following when the firewall is running things are not working: ## Code: ## ip -s link /usr/sbin/iptables -nvL Finally, post the output from the same commands after booting with the firewall initially disabled but then started when things are working correctly. Good luck. ---
**Author:** ![g\_hammer](https://avatars.discourse-cdn.com/v4/letter/g/67e7ee/32.png) [@g\_hammer](https://forums.suse.com/u/g_hammer)\ **Post date:** [June 3, 2013, 2:31pm UTC](https://forums.suse.com/t/firewall-is-blocking-all/24021/3 "2013-06-03T14:31:01Z")
Hi, thanks for your answer. Here the outputs. ip addr output is: 1: lo: \ mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo inet 127.0.0.2/8 brd 127.255.255.255 scope host secondary lo inet6 ::1/128 scope host valid\_lft forever preferred\_lft forever 2: em1: \ mtu 1500 qdisc mq state UP qlen 1000 link/ether e0:db:55:1f:a3:12 brd ff:ff:ff:ff:ff:ff inet 131.173.111.149/23 brd 131.173.111.255 scope global em1 inet6 fe80::e2db:55ff:fe1f:a312/64 scope link valid\_lft forever preferred\_lft forever 3: em2: \ mtu 1500 qdisc noop state DOWN qlen 1000 link/ether e0:db:55:1f:a3:14 brd ff:ff:ff:ff:ff:ff ip route output is: default via 131.173.111.254 dev em1 127.0.0.0/8 dev lo scope link 131.173.110.0/23 dev em1 proto kernel scope link src 131.173.111.149 ip -s link output when not working: 1: lo: \ mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 brd 127.255.255.255 scope host lo inet 127.0.0.2/8 brd 127.255.255.255 scope host secondary lo inet6 ::1/128 scope host valid\_lft forever preferred\_lft forever 2: em1: \ mtu 1500 qdisc mq state UP qlen 1000 link/ether e0:db:55:1f:a3:12 brd ff:ff:ff:ff:ff:ff inet 131.173.111.149/23 brd 131.173.111.255 scope global em1 inet6 fe80::e2db:55ff:fe1f:a312/64 scope link valid\_lft forever preferred\_lft forever 3: em2: \ mtu 1500 qdisc noop state DOWN qlen 1000 link/ether e0:db:55:1f:a3:14 brd ff:ff:ff:ff:ff:ff ip -s link output when working: 1: lo: \ mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 RX: bytes packets errors dropped overrun mcast 3678447 5228 0 0 0 0 TX: bytes packets errors dropped carrier collsns 3678447 5228 0 0 0 0 2: em1: \ mtu 1500 qdisc mq state UP qlen 1000 link/ether e0:db:55:1f:a3:12 brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped overrun mcast 24337807 57230 0 556 0 4746 TX: bytes packets errors dropped carrier collsns 6505926 23458 0 0 0 0 3: em2: \ mtu 1500 qdisc noop state DOWN qlen 1000 link/ether e0:db:55:1f:a3:14 brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped overrun mcast 0 0 0 0 0 0 TX: bytes packets errors dropped carrier collsns 0 0 0 0 0 0 iptables -nvL output when not working: Chain INPUT (policy DROP 995 packets, 155K bytes) pkts bytes target prot opt in out source destination 71 168K ACCEPT all – lo \* 0.0.0.0/0 0.0.0.0/0 677 79517 ACCEPT all – \* \* 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED 0 0 ACCEPT icmp – \* \* 0.0.0.0/0 0.0.0.0/0 state RELATED Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 679 packets, 50292 bytes) pkts bytes target prot opt in out source destination 73 168K ACCEPT all – \* lo 0.0.0.0/0 0.0.0.0/0 Chain reject\_func (0 references) pkts bytes target prot opt in out source destination 0 0 REJECT tcp – \* \* 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset 0 0 REJECT udp – \* \* 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 REJECT all – \* \* 0.0.0.0/0 0.0.0.0/0 reject-with icmp-proto-unreachable iptables -nvL output when working: Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 27 2587 ACCEPT all – lo \* 0.0.0.0/0 0.0.0.0/0 391 34556 ACCEPT all – \* \* 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED 0 0 ACCEPT icmp – \* \* 0.0.0.0/0 0.0.0.0/0 state RELATED 170 30429 input\_ext all – em1 \* 0.0.0.0/0 0.0.0.0/0 0 0 input\_ext all – em2 \* 0.0.0.0/0 0.0.0.0/0 0 0 input\_ext all – \* \* 0.0.0.0/0 0.0.0.0/0 0 0 LOG all – \* \* 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix `SFW2-IN-ILL-TARGET ’ 0 0 DROP all – \* \* 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 LOG all – \* \* 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix `SFW2-FWD-ILL-ROUTING ’ Chain OUTPUT (policy ACCEPT 363 packets, 257K bytes) pkts bytes target prot opt in out source destination 27 2587 ACCEPT all – \* lo 0.0.0.0/0 0.0.0.0/0 Chain forward\_ext (0 references) pkts bytes target prot opt in out source destination Chain input\_ext (3 references) pkts bytes target prot opt in out source destination 163 29969 DROP all – \* \* 0.0.0.0/0 0.0.0.0/0 PKTTYPE = broadcast 0 0 ACCEPT icmp – \* \* 0.0.0.0/0 0.0.0.0/0 icmp type 4 0 0 ACCEPT icmp – \* \* 0.0.0.0/0 0.0.0.0/0 icmp type 8 0 0 LOG tcp – \* \* 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpts:12097:12099 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:12097:12099 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:4544 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ’ 0 0 ACCEPT tcp – \* \* 0.0.0.0/0 0.0.0.0/0 tcp dpt:4544 0 0 LOG tcp – \* \* 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:9090 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:22 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ’ 0 0 ACCEPT tcp – \* \* 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 6 380 LOG all – \* \* 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 PKTTYPE = multicast LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT ' 7 460 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE = multicast 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE = broadcast 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT ’ 0 0 LOG icmp – \* \* 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT ' 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 state NEW LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT ’ 0 0 DROP all – \* \* 0.0.0.0/0 0.0.0.0/0 Chain reject\_func (0 references) pkts bytes target prot opt in out source destination 0 0 REJECT tcp – \* \* 0.0.0.0/0 0.0.0.0/0 reject-with tcp-reset 0 0 REJECT udp – \* \* 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 REJECT all – \* \* 0.0.0.0/0 0.0.0.0/0 reject-with icmp-proto-unreachable Best regards Gerlinde Hammer ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [June 3, 2013, 3:09pm UTC](https://forums.suse.com/t/firewall-is-blocking-all/24021/4 "2013-06-03T15:09:19Z")
On 06/03/2013 05:34 AM, g hammer wrote:[color=blue] > ip -s link output when not working: > > 1: lo: \ mtu 16436 qdisc noqueue state UNKNOWN > link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 > inet 127.0.0.1/8 brd 127.255.255.255 scope host lo > inet 127.0.0.2/8 brd 127.255.255.255 scope host secondary lo > inet6 ::1/128 scope host > valid\_lft forever preferred\_lft forever > 2: em1: \ mtu 1500 qdisc mq state UP > qlen 1000 > link/ether e0:db:55:1f:a3:12 brd ff:ff:ff:ff:ff:ff > inet 131.173.111.149/23 brd 131.173.111.255 scope global em1 > inet6 fe80::e2db:55ff:fe1f:a312/64 scope link > valid\_lft forever preferred\_lft forever > 3: em2: \ mtu 1500 qdisc noop state DOWN qlen 1000 > link/ether e0:db:55:1f:a3:14 brd ff:ff:ff:ff:ff:ff[/color] I think this is actually ‘ip addr’ output. Can we get the ‘ip -s link’ output when not working? Also, for anything pasted please put it within Code tags which I think is detailed in some of the forum docs if you are unfamiliar with the practice. This basically preserves the layout of the data so that it looks the same to me as it did to you in a terminal. [color=blue] > iptables -nvL output when not working: > > Chain INPUT (policy DROP 995 packets, 155K bytes) > pkts bytes target prot opt in out source > destination > 71 168K ACCEPT all – lo \* 0.0.0.0/0 > 0.0.0.0/0 > 677 79517 ACCEPT all – \* \* 0.0.0.0/0 > 0.0.0.0/0 state ESTABLISHED > 0 0 ACCEPT icmp – \* \* 0.0.0.0/0 > 0.0.0.0/0 state RELATED > > Chain FORWARD (policy DROP 0 packets, 0 bytes) > pkts bytes target prot opt in out source > destination > > Chain OUTPUT (policy ACCEPT 679 packets, 50292 bytes) > pkts bytes target prot opt in out source > destination > 73 168K ACCEPT all – \* lo 0.0.0.0/0 > 0.0.0.0/0 > > Chain reject\_func (0 references) > pkts bytes target prot opt in out source > destination > 0 0 REJECT tcp – \* \* 0.0.0.0/0 > 0.0.0.0/0 reject-with tcp-reset > 0 0 REJECT udp – \* \* 0.0.0.0/0 > 0.0.0.0/0 reject-with icmp-port-unreachable > 0 0 REJECT all – \* \* 0.0.0.0/0 > 0.0.0.0/0 reject-with icmp-proto-unreachable > > iptables -nvL output when working: > > Chain INPUT (policy DROP 0 packets, 0 bytes) > pkts bytes target prot opt in out source > destination > 27 2587 ACCEPT all – lo \* 0.0.0.0/0 > 0.0.0.0/0 > 391 34556 ACCEPT all – \* \* 0.0.0.0/0 > 0.0.0.0/0 state ESTABLISHED > 0 0 ACCEPT icmp – \* \* 0.0.0.0/0 > 0.0.0.0/0 state RELATED > 170 30429 input\_ext all – em1 \* 0.0.0.0/0 > 0.0.0.0/0 > 0 0 input\_ext all – em2 \* 0.0.0.0/0 > 0.0.0.0/0 > 0 0 input\_ext all – \* \* 0.0.0.0/0 > 0.0.0.0/0 > 0 0 LOG all – \* \* 0.0.0.0/0 > 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix > `SFW2-IN-ILL-TARGET ’ > 0 0 DROP all – \* \* 0.0.0.0/0 > 0.0.0.0/0 > > Chain FORWARD (policy DROP 0 packets, 0 bytes) > pkts bytes target prot opt in out source > destination > 0 0 LOG all – \* \* 0.0.0.0/0 > 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix > `SFW2-FWD-ILL-ROUTING ’ > > Chain OUTPUT (policy ACCEPT 363 packets, 257K bytes) > pkts bytes target prot opt in out source > destination > 27 2587 ACCEPT all – \* lo 0.0.0.0/0 > 0.0.0.0/0 > > Chain forward\_ext (0 references) > pkts bytes target prot opt in out source > destination > > Chain input\_ext (3 references) > pkts bytes target prot opt in out source > destination > 163 29969 DROP all – \* \* 0.0.0.0/0 > 0.0.0.0/0 PKTTYPE = broadcast > 0 0 ACCEPT icmp – \* \* 0.0.0.0/0 > 0.0.0.0/0 icmp type 4 > 0 0 ACCEPT icmp – \* \* 0.0.0.0/0 > 0.0.0.0/0 icmp type 8 > 0 0 LOG tcp – \* \* 0.0.0.0/0 > 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpts:12097:12099 > flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:12097:12099 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:4544 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ’ > 0 0 ACCEPT tcp – \* \* 0.0.0.0/0 > 0.0.0.0/0 tcp dpt:4544 > 0 0 LOG tcp – \* \* 0.0.0.0/0 > 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:9090 > flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ' 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp dpt:22 flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-ACC-TCP ’ > 0 0 ACCEPT tcp – \* \* 0.0.0.0/0 > 0.0.0.0/0 tcp dpt:22 > 6 380 LOG all – \* \* 0.0.0.0/0 > 0.0.0.0/0 limit: avg 3/min burst 5 PKTTYPE = multicast LOG > flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT ' 7 460 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE = multicast 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 PKTTYPE = broadcast 0 0 LOG tcp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 tcp flags:0x17/0x02 LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT ’ > 0 0 LOG icmp – \* \* 0.0.0.0/0 > 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 6 level 4 prefix > `SFW2-INext-DROP-DEFLT ' 0 0 LOG udp -- * * 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 state NEW LOG flags 6 level 4 prefix `SFW2-INext-DROP-DEFLT ’ > 0 0 DROP all – \* \* 0.0.0.0/0 > 0.0.0.0/0 > > Chain reject\_func (0 references) > pkts bytes target prot opt in out source > destination > 0 0 REJECT tcp – \* \* 0.0.0.0/0 > 0.0.0.0/0 reject-with tcp-reset > 0 0 REJECT udp – \* \* 0.0.0.0/0 > 0.0.0.0/0 reject-with icmp-port-unreachable > 0 0 REJECT all – \* \* 0.0.0.0/0 > 0.0.0.0/0 reject-with icmp-proto-unreachable[/color] Well this is quite the difference. When working there are a bunch of rules setup for em1 and em2, and everything else really, to allow a bunch of things through the firewall. When not working… not so much and therefore it appears that things just hit the default DROP policy and go away. You mentioned this started when you changed IP and “name” which I assume means the server hostname. Neither of those changes have ever tweaked the firewall for me, so are you sure there were no other changes at the time, either to networking, the firewall, or maybe with SLES patches? Also, if you go into your firewall configuration now (`/sbin/yast firewall`) and look at things in there do you see your NIC(s) set for the proper (probably external) zone? When you disable the firewall (after rebooting with it enabled when things are not working at all) what do you get from the same `iptables -nvL` command? A disabled firewall is not really disabled, it is just infinitely tolerant of traffic and typically has no rules with default policies of ACCEPT so everything just moves through without NetFilter (the firewall) restrictions. Do you have any other scripts or code that is configuring your firewall? For example, some of these port ranges are unfamiliar to me at first glance, so is there an application in particular on the box that may be trying to configure the firewall for you which could be upset now that the system is reconfigured? Good luck. ---
**Author:** ![g\_hammer](https://avatars.discourse-cdn.com/v4/letter/g/67e7ee/32.png) [@g\_hammer](https://forums.suse.com/u/g_hammer)\ **Post date:** [June 6, 2013, 10:03am UTC](https://forums.suse.com/t/firewall-is-blocking-all/24021/5 "2013-06-06T10:03:34Z")
Hi, you were right: there was a different script that prevented the firewall from start completely. Thanks for the hint. Best regards Gerlinde ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [June 6, 2013, 3:06pm UTC](https://forums.suse.com/t/firewall-is-blocking-all/24021/6 "2013-06-06T15:06:04Z")
Well that was a lucky guess then. Thank-you for posting back your results; I was beginning to worry that I didn’t understand the Yast-based firewall nearly as well as I thought I did. Good luck.