asked on

Iptables mystery for linux newbie

I've got a Ubuntu (latest build) box at Rackspace which is running the telephony app Asterisk. This is working fine. I cloned it and the clone's Asterisk wouldn't let any phone registrations through.
Someone suggested turning off the iptables, and lo and behold, it worked.
The iptables were cloned, why would they behave differently?
(the iptables were originally setup by someone who knew what they were doing-unlike me!, so i'd like to re-instate them but I don't know what stopped working)

ASKER CERTIFIED SOLUTION

itnifl

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Silas2

ASKER

These are virtual servers so they don't have their own NIC cards, i'm guessing they must have the same form..

Silas2

ASKER

Actually, thanks for your help. I think that solved it, I asked Rackspace if there was anyway the NIC cards could appear differently, then they admitted that when you clone a server, unless you tick the 'unsubscribe' box to monitoring, they add a ton of iptable rules, and when I compared the rules in the working server, there was only a couple.

itnifl

Nice. If I remember correctly I had a similar problem once. In that case the clone still had the udev rules from the original, but thought its virtual nics were different ones and therefore generated new names and put them in the persistent net rules(/etc/udev/rules.d/70-persistent-net.rules). I think because the clone got new mac addresses for his nics, then then original had. So then then the iptable rules no longer matched the nic names.

If you see this article here (you almost have to have javascript enabled to view that page):
http://itblog.team-holm.net/index.php?scriptName=Hyper-V&subSection=false#HYPER_GCRFBTS

You will see a script at the end that prepares a Centos VM to be a template for further deployment. One of the things that the script does is to remove the udev rules (rm -rf /etc/udev/rules.d/70-persistent-net.rules) so that the problem I described above does not happen. Doing so is fine for a template, but not necessarily a good idea for your original.

Silas2

ASKER

Thanks