0

I tried using the below IPTABLES config(a few of the ports are changed), however, the endorser missed a block this morning, I think the IPTABLES rules are preventing it from talking to the node, but I'm not sure.

Allow related connections

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Allow loopback interface

iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT

Allow SSH for now, so our connection is not disrupted, we will enable/disable SSH access via our security groups on the cloud provider. We will tighten this up in future versions

iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow Tezos P2P connections

iptables -A INPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 9732 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow NBD

iptables -A OUTPUT -p tcp --dport $MY_NBD_PORT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Allow DNS

iptables -A OUTPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow NTP

iptables -A INPUT -p udp --source-port 123:123 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -p udp --destination-port 123:123 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow DHCP

iptables -A INPUT -i eth0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT

Setup loggers

iptables -N LOG_AND_DROP_IN iptables -A LOG_AND_DROP_IN -j LOG --log-prefix "IPTABLES:DROP:IN:" iptables -A LOG_AND_DROP_IN -j DROP

iptables -N LOG_AND_DROP_OUT iptables -A LOG_AND_DROP_OUT -j LOG --log-prefix "IPTABLES:DROP:OUT:" iptables -A LOG_AND_DROP_OUT -j DROP

iptables -N LOG_AND_DROP_FWD iptables -A LOG_AND_DROP_FWD -j LOG --log-prefix "IPTABLES:DROP:FWD:" iptables -A LOG_AND_DROP_FWD -j DROP

Log and drop everything else

iptables -A INPUT -j LOG_AND_DROP_IN iptables -A FORWARD -j LOG_AND_DROP_FWD iptables -A OUTPUT -j LOG_AND_DROP_OUT

Default to drop everything

iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP

1

If your node is configured using defaults, then your tezos-node should be listening on 127.0.0.1:8732, which you already have a rule to allow (loopback). If the endorser cannot talk to the RPC, it will immediately die and will not start back up so this is easy to test.

What was the message in the endorser? Did you inject the op yet still miss? Did others also miss the same block? Might not have been you at all.

Side note, are you running a DHCP server on this same server? If not, then you don't need that INPUT rule. You would only need OUTPUT to contact your DHCP server if you indeed get auto-assigned IPs.

4
  • There was no injection, and the endorser was running, which is why I thought it was a bit weird....
    – Mack Baise
    Aug 16 '20 at 0:22
  • If there was no injection, then what did the endorser logs say?
    – utdrmac
    Aug 16 '20 at 3:56
  • I looked but there wasn't anything. It's working today though, maybe it was just bad luck.
    – Mack Baise
    Aug 17 '20 at 8:44
  • @MackBaise Please mark the answer accepted then so it can be closed out.
    – utdrmac
    Aug 18 '20 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.