I am using Debian 9.8 Stretch x64 in a server. Yesterday I updated from official repository the kernel files form 4.9.133 to 4.9.144. After rebooting I couldn't access my server. All ports were blocked. I started a VNC connection and flushed the firewall. Everything was backed to normal.
One by one I analyzed iptables rules (I am not using Firewalld, ufw, ...). When I inserted the rule for geoip module (INPUT I INPUT -m geoip --src-cc CN,IN - REJECT --reject-with icmp-port-unreachable) I couldn't continue ssh session. I used again VNC to delete the rule.
What I did so far:
- modprobe xt_geoip command is not giving any error message.
- depmod -a command ran without any issues.
- lsmod | grep xt_geoip command shows as result two lines, one xt_geoip and x_tables.
- removed and purged xtables-addons-commons and apt-get autoremove, then I installed again everything from scratch.
- I used an old geo_ip database (BE/LE folders) from 2017 and 2018 with no luck. So the issue is not related to IP's database xtables uses.
In my opinion module is loaded by the kernel. I will try to re-install in a test machine kernel 4.9.133. If it will work then there is a bug in the new kernel version 4.9.144 which creates issues with xtables-addons/geoip module.