What settings should I use for IPTABLES so the endorser and baker run properly?

Question

I tried using the below IPTABLES config(a few of the ports are changed), however, the endorser missed a block this morning, I think the IPTABLES rules are preventing it from talking to the node, but I'm not sure.

Allow related connections

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Allow loopback interface

iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT

Allow SSH for now, so our connection is not disrupted, we will enable/disable SSH access via our security groups on the cloud provider. We will tighten this up in future versions

iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow Tezos P2P connections

iptables -A INPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --dport 9732 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 9732 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allow NBD

iptables -A OUTPUT -p tcp --dport $MY_NBD_PORT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Allow DNS

iptables -A OUTPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow NTP

iptables -A INPUT -p udp --source-port 123:123 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -p udp --destination-port 123:123 -m state --state NEW,ESTABLISHED -j ACCEPT

Allow DHCP

iptables -A INPUT -i eth0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT

Setup loggers

iptables -N LOG_AND_DROP_IN iptables -A LOG_AND_DROP_IN -j LOG --log-prefix "IPTABLES:DROP:IN:" iptables -A LOG_AND_DROP_IN -j DROP

iptables -N LOG_AND_DROP_OUT iptables -A LOG_AND_DROP_OUT -j LOG --log-prefix "IPTABLES:DROP:OUT:" iptables -A LOG_AND_DROP_OUT -j DROP

iptables -N LOG_AND_DROP_FWD iptables -A LOG_AND_DROP_FWD -j LOG --log-prefix "IPTABLES:DROP:FWD:" iptables -A LOG_AND_DROP_FWD -j DROP

Log and drop everything else

iptables -A INPUT -j LOG_AND_DROP_IN iptables -A FORWARD -j LOG_AND_DROP_FWD iptables -A OUTPUT -j LOG_AND_DROP_OUT

Default to drop everything

iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP

Answer 1

If your node is configured using defaults, then your tezos-node should be listening on 127.0.0.1:8732, which you already have a rule to allow (loopback). If the endorser cannot talk to the RPC, it will immediately die and will not start back up so this is easy to test.

What was the message in the endorser? Did you inject the op yet still miss? Did others also miss the same block? Might not have been you at all.

Side note, are you running a DHCP server on this same server? If not, then you don't need that INPUT rule. You would only need OUTPUT to contact your DHCP server if you indeed get auto-assigned IPs.