0

I am using Debian 9.8 Stretch x64 in a server. Yesterday I updated from official repository the kernel files form 4.9.133 to 4.9.144. After rebooting I couldn't access my server. All ports were blocked. I started a VNC connection and flushed the firewall. Everything was backed to normal.

One by one I analyzed iptables rules (I am not using Firewalld, ufw, ...). When I inserted the rule for geoip module (INPUT I INPUT -m geoip --src-cc CN,IN - REJECT --reject-with icmp-port-unreachable) I couldn't continue ssh session. I used again VNC to delete the rule.

What I did so far:

  • modprobe xt_geoip command is not giving any error message.
  • depmod -a command ran without any issues.
  • lsmod | grep xt_geoip command shows as result two lines, one xt_geoip and x_tables.
  • removed and purged xtables-addons-commons and apt-get autoremove, then I installed again everything from scratch.
  • I used an old geo_ip database (BE/LE folders) from 2017 and 2018 with no luck. So the issue is not related to IP's database xtables uses.

In my opinion module is loaded by the kernel. I will try to re-install in a test machine kernel 4.9.133. If it will work then there is a bug in the new kernel version 4.9.144 which creates issues with xtables-addons/geoip module.

1 Answer 1

0

I was having similar problems since Maxmind deprecated the old format databases in January 2019.

I also attempted to revert to older xt_geoip database files, without success. I additionally tried adapting newer xtables-addons scripts to download from the newer Maxmind database. All of those things failed.

In the end, I used conversion scripts from: https://github.com/mschmitt/GeoLite2xtables and referenced in Converting GeoLite2 data for use with xtables geoip to download and convert the new Maxmind files.

I did run into additional snags:

1) During one of the unsuccessful attempts to resolve this, files like ".iv4" and "1.iv4" were created. I removed all files/directories/etc in /usr/share/xt_geoip/BE and /usr/share/xt_geoip/LE

2) I then used the information at the above links to download and build xtables database files from the GeoLite2 data.

3) At this point, my existing iptables geoip based rules still did not work. But removing the rule and re-adding it caused it to start functioning. Not positive why I had to take that action (caching? loads databases at rule creation? no idea).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.