Probleme mit Firewall

Hallo,

durch Zufall gerade gesehen, dass der Server nach dem Neustart irgendein Problem mit der Firewall hat:

ufw status

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Hab dann über das SCP einen Neustart durchgeführt, jetzt läuft uw anscheinend gar nicht mehr:

ufw enable

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y

ERROR: problem running ufw-init

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

iptables-restore v1.8.4 (legacy): Couldn't load target `ufw-skip-to-policy-input':No such file or directory

Error occurred at line: 19

Try `iptables-restore -h' or 'iptables-restore --help' for more information.

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

ip6tables-restore v1.8.4 (legacy): Couldn't load target `ufw6-user-input':No such file or directory

Error occurred at line: 2

Try `ip6tables-restore -h' or 'ip6tables-restore --help' for more information.

Problem running '/etc/ufw/before.rules'

Problem running '/etc/ufw/after.rules'

Problem running '/etc/ufw/user.rules'

Problem running '/etc/ufw/after6.rules'

Problem running '/etc/ufw/user6.rules'

Kann jemand helfen?

Danke

So hier noch ein paar Infos:

Ubuntu 20.0.4 LTS

Custom SSH Port und auch IPv6

letzes Update gestern

keine anderen Scripte

und auch nichts geändert

Schaue heute Abend nach, Server ist runtergefahren...

Ja bin als root angemeldet, in dem Fall. Root aber deaktiviert

ufw ist natürlich vorher gelaufen. IWr mit Uptime Kuma überprüft. Da läuft was hinter der Firewall. Ist es erreichbar ist die Firewall aus und Kuma schlägt Alarm.

systemctl status ufw.service:

ufw.service - Uncomplicated firewall
Loaded: loaded (/lib/systemd/system/ufw.service; enabled; vendor preset: enabled)
Active: active (exited) since Wed 2023-04-19 19:50:42 CEST; 3min 12s ago
Docs: man:ufw(8)
Process: 374 ExecStart=/lib/ufw/ufw-init start quiet (code=exited, status=0/SUCCESS)
Main PID: 374 (code=exited, status=0/SUCCESS)

Warning: journal has been rotated since unit was started, output may be incomplete.

---

sudo iptables -L

Another app is currently holding the xtables lock. Perhaps you want to use the -w option?

---

lsof | grep xtable

keine Ausgabe

---

UFW Version:

0.36

Und nebenbei bemerkt kann ich z.B. nichts mehr anpingen etc.

W: Failed to fetch http://de.archive.ubuntu.com/ubuntu/dists/focal/InRelease Temporary failure resolving 'de.archive.ubuntu.com'
W: Failed to fetch http://de.archive.ubuntu.com/u…s/focal-updates/InRelease Temporary failure resolving 'de.archive.ubuntu.com'
W: Failed to fetch http://de.archive.ubuntu.com/u…focal-backports/InRelease Temporary failure resolving 'de.archive.ubuntu.com'
W: Failed to fetch http://security.ubuntu.com/ubu…/focal-security/InRelease Temporary failure resolving 'security.ubuntu.com'
W: Failed to fetch https://download.docker.com/li…ntu/dists/focal/InRelease Temporary failure resolving 'download.docker.com'
W: Failed to fetch https://esm.ubuntu.com/apps/ub…l-apps-security/InRelease Temporary failure resolving 'esm.ubuntu.com'
W: Failed to fetch https://esm.ubuntu.com/apps/ub…al-apps-updates/InRelease Temporary failure resolving 'esm.ubuntu.com'
W: Failed to fetch https://esm.ubuntu.com/infra/u…-infra-security/InRelease Temporary failure resolving 'esm.ubuntu.com'
W: Failed to fetch https://esm.ubuntu.com/infra/u…l-infra-updates/InRelease Temporary failure resolving 'esm.ubuntu.com'

Meine Docker Container sind aber von außen erreichbar.

Zitat von engine

Es sieht so aus, als wäre auch dein DNS im Eimer. Was sagt z.B. dig google.de?

; <<>> DiG 9.16.1-Ubuntu <<>> google.de
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 52365
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;google.de. IN A

;; Query time: 112 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Wed Apr 19 20:25:09 CEST 2023
;; MSG SIZE rcvd: 38

Zitat von lindesbs

Loest sich das Problem eigentlich nach einiger Zeit? Du koenntest mal schauen, welche Scripte wie lange zum hochfahren brauchen:

Code

systemd-analyze blame

Es koennte auch ein iptables-restore sein, der nach dem Neustart den alten Zustand wiederherstellen moechte. Das paat dann natuerlch zu dem DNS Problemen, weil er im Normalfall auch Namen aufloesen moechte.

Bekommst du deine IP per DHCP oder statisch? Hast Du mal den DNS auf den GoogleDNS gesetzt (8.8.8.8)

Die netcup Nameserver sind oftmals nicht sehr performant.

13.276s ipset-blacklist.service
5.165s docker.service
2.838s snapd.service
2.744s postfix@-.service
2.158s systemd-udev-settle.service
2.089s dev-vda3.device
1.759s systemd-networkd-wait-online.service
1.409s networkd-dispatcher.service
1.325s snapd.seeded.service
1.177s accounts-daemon.service
1.147s udisks2.service
898ms systemd-journal-flush.service
846ms ModemManager.service
768ms systemd-logind.service
677ms polkit.service
571ms lvm2-monitor.service
540ms containerd.service
495ms systemd-random-seed.service
452ms rsyslog.service
442ms grub-common.service
437ms e2scrub_reap.service
432ms apparmor.service
419ms keyboard-setup.service
343ms snap-canonical\x2dlivepatch-196.mount
338ms snap-canonical\x2dlivepatch-202.mount
337ms systemd-journald.service
328ms snap-core-14946.mount
308ms modprobe@ramoops.service
303ms systemd-sysctl.service
293ms ssh.service
286ms modprobe@chromeos_pstore.service
243ms systemd-remount-fs.service
241ms dev-loop1.device
236ms systemd-modules-load.service
236ms dev-loop2.device
214ms snapd.apparmor.service
197ms modprobe@efi_pstore.service
197ms apport.service
191ms systemd-udevd.service
187ms sys-kernel-debug.mount
186ms sys-kernel-tracing.mount
181ms systemd-timesyncd.service
181ms user@1000.service
180ms dev-hugepages.mount
179ms dev-mqueue.mount
161ms kmod-static-nodes.service
139ms systemd-resolved.service
115ms multipathd.service
106ms systemd-fsck@dev-disk-by\x2duuid-23d5c5c8\x2d70ee\x2d4708\x2d8d25\x2d758eb930eb54.service
89ms ufw.service
88ms systemd-sysusers.service
86ms modprobe@pstore_blk.service
81ms dev-loop0.device
79ms systemd-networkd.service
71ms systemd-udev-trigger.service
56ms grub-initrd-fallback.service
55ms sys-fs-fuse-connections.mount
45ms boot.mount
42ms plymouth-read-write.service
40ms systemd-tmpfiles-setup-dev.service
32ms sys-kernel-config.mount
31ms proc-sys-fs-binfmt_misc.mount
28ms console-setup.service
24ms systemd-tmpfiles-setup.service
21ms atd.service
19ms systemd-user-sessions.service
17ms systemd-update-utmp.service
17ms fail2ban.service
17ms setvtrgb.service
16ms blk-availability.service

Und ja DNS hatte ich schon mal getauscht. Ändert aber weder an der UFW Thematik noch am DNS Problem was

Immerhin hat sich was geändert:

ufw status
Status: inactive
ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
ERROR: problem running ufw-init
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
iptables-restore v1.8.4 (legacy): Couldn't load target `ufw-skip-to-policy-input':No such file or directory

Error occurred at line: 19
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
iptables-restore v1.8.4 (legacy): Couldn't load target `ufw-user-input':No such file or directory

Error occurred at line: 2
Try `iptables-restore -h' or 'iptables-restore --help' for more information.

Problem loading ipv6 (skipping)
Problem running '/etc/ufw/before.rules'
Problem running '/etc/ufw/after.rules'
Problem running '/etc/ufw/user.rules'

Ja das IP Blacklist Skript, lädt die IPs für die Blacklisten.

Das aber schon 2 Jahre ohne geändert worden zu sein

/etc/resolv.conf:

# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients to the
# internal DNS stub resolver of systemd-resolved. This file lists all
# configured search domains.
#
# Run "resolvectl status" to see details about the uplink DNS servers
# currently in use.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.53
options edns0 trust-ad

Zitat von engine

Hast du überhaupt einen lokalen Nameserver installiert? Mir kommt das alles sehr komisch vor. Was steht in /etc/network/interfaces? Falls das nicht über netplan gelöst ist bei Ubuntu…

Wie gesagt, an der reslov.conf hab ich nie was geändert.

GNU nano 4.8 /etc/network/interfaces
# ifupdown has been replaced by netplan(5) on this system. See
# /etc/netplan for current configuration.
# To re-enable ifupdown on this system, you can run:
# sudo apt install ifupdown