Good Morning all!
This morning I had a strange IPTABLES rule, which caused a total
blocking of everything coming in or out in the forwarding section.
System: Here's a OpenVZ Server running, having OSSEC on the Host as an
agent. The agent is looking into the Containers Logfiles and usualy
reacting in the right way. Suddenly I got a message from my monitoring
system, that all Containers on this host are not reacheable anymore.
I (lucky) could log into the host and found this rule with IPTABLES -L
under Chain FORWARD (policy ACCEPT):
DROP all -- anywhere anywhere
How can this be?
I have already inspected all OSSEC-Logs on the Host and on the
OSSEC-Server for 'anywhere' or '0.0.0.0' but cannot found a record which
could raise such a rule.
Does anybody know, where this rule is coming from AND how to avoid it?
