Is there any entry in the active-response.log? Are you sure OSSEC
entered this IPTABLES rule?
Regards
Andre Pawlowski
-------------------------------------------------------------------
When we don't know who to hate, we hate ourselves.
-Chuck Palahniuk
On 08/20/2010 09:33 AM, WebOscar.net wrote:
> Good Morning all!
>
> This morning I had a strange IPTABLES rule, which caused a total
> blocking of everything coming in or out in the forwarding section.
>
> System: Here's a OpenVZ Server running, having OSSEC on the Host as an
> agent. The agent is looking into the Containers Logfiles and usualy
> reacting in the right way. Suddenly I got a message from my monitoring
> system, that all Containers on this host are not reacheable anymore.
>
> I (lucky) could log into the host and found this rule with IPTABLES -L
> under Chain FORWARD (policy ACCEPT):
>
> DROP all -- anywhere anywhere
>
> How can this be?
>
> I have already inspected all OSSEC-Logs on the Host and on the
> OSSEC-Server for 'anywhere' or '0.0.0.0' but cannot found a record which
> could raise such a rule.
>
> Does anybody know, where this rule is coming from AND how to avoid it?
>
