How to add rule with IPTables.Net to iptables in real system with .NET 6 Web API

Question

I have a .NET 6 Web API application and I want to edit my iptables rule in hosted system. (the system that Web API run on it)

I have rule like below

-A INPUT -m tcp  --protocol tcp --source 2.2.2.2 --destination 1.1.1.1 --source-port 111 --destination-port 222 --jump DROP

I try this rule in iptables command in bash and work correctly, but when I try to create rule for this like below

IpTablesRule rule = IpTablesRule.Parse($"-A  INPUT  -m tcp--protocol tcp --source 2.2.2.2 --destination 1.1.1.1 --source-port 111 --destination-port 222 --jump DROP", null, chains);

and then try to add to system like below

ipTablesSystem = new IpTablesSystem(system: new LocalFactory(), tableAdapter: new IPTablesBinaryAdapter());
inputChain = ipTablesSystem.GetChain(table: Table.FILTER, chain: Chain.INPUT, ipVersion: (int)IpVersion.V4);
inputChain.AddRule(rule);

No any error rise on system or something like that, but after I try to see system rules with bash (cli) with iptables -L I do not see my rules

Why my rule does not exist in system? and how to resolve this problem?

Please don't create unrelated tags. There's no such thing as c#-iptables. This only creates noise — Panagiotis Kanavos
– Panagiotis Kanavos, Commented Aug 10, 2023 at 12:42
Besides, it would be very strange if a web application could make system modifications or worse, modify firewalls. That's what every hacker wishes. Web apps run under restricted accounts that typically can't even access folders outside the web site, much less open firewall ports — Panagiotis Kanavos
– Panagiotis Kanavos, Commented Aug 10, 2023 at 12:45
In any case, the source code shows that inputChain.AddRule adds an object to a collection, it doesn't execute iptables at all. The IPTablesLibAdapterClient.AddRule does. Don't rush to use it though without understanding what's going on because you could end up causing serious problems. Let the deployment script take care of network setup. — Panagiotis Kanavos
– Panagiotis Kanavos, Commented Aug 10, 2023 at 12:52
Above code does not publish yet on PR, I refer to project, for better explanation. many web base remote iptables project exist for example github.com/palner/iptables-api — sorosh_sabz
– sorosh_sabz, Commented Aug 10, 2023 at 12:59
Doesn't change the fact that web apps can't modify firewalls (just dare ask the machine's admin what you tried) and inputChain.AddRule doesn't execute anything. API doesn't mean "Web" or "Remote". Yes, there are a lot of libraries but they only work if the executing account has permission to make modifications. And web apps should never, ever have such permissions — Panagiotis Kanavos
– Panagiotis Kanavos, Commented Aug 10, 2023 at 13:05

sorosh_sabz · Accepted Answer · 2023-08-17 09:50:40Z

1

This is for bad using of API, the correct way is like below

IpTablesRule rule = IpTablesRule.Parse($"-A  INPUT  -m tcp --protocol tcp --source 2.2.2.2 --destination 1.1.1.1 --source-port 111 --destination-port 222 --jump DROP", null, chains);

var ipTablesSystem = new IpTablesSystem(system: new LocalFactory(), tableAdapter: ipTablesAdapter);

IIPTablesAdapterClient table = ipTablesSystem.GetTableAdapter((int)IpVersion.V4);

table.AddRule(rule);

The note is, you must get table from IpTablesSystem and add or remove rulse from table.

answered Aug 17, 2023 at 9:50

sorosh_sabz

3,0533 gold badges39 silver badges76 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to add rule with IPTables.Net to iptables in real system with .NET 6 Web API

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related