SNMP Trap - Firewall Rules

Firewall Rules

These steps explain how to check if the Operating System (OS) of the Nagios server has firewall rules enabled to allow inbound SNMP Trap UDP port 162 traffic. The different supported OS's have different firewall commands which are explained as follows.

You will need to establish an SSH session to the Nagios server that is receiving SNMP Traps.

RHEL  | CentOS | Oracle Linux 

First check the status of the firewall:

systemctl status firewalld.service

IF the firewall is running, it should product output like:

● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Tue 2018-11-20 10:05:15 AEDT; 1 weeks 0 days ago
     Docs: man:firewalld(1)
 Main PID: 647 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─647 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

IF the firewall is NOT running, it will produce this output:

● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Tue 2018-11-27 14:11:34 AEDT; 965ms ago
     Docs: man:firewalld(1)
 Main PID: 647 (code=exited, status=0/SUCCESS)

If the firewall is NOT running, this means that inbound traffic is allowed.

To ENABLE the firewall on boot and to start it, execute the following commands:

systemctl enable firewalld.service
systemctl start firewalld.service

To list the firewall rules execute this command:

firewall-cmd --list-all

Which should produce output like:

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens32
  sources: 
  services: dhcpv6-client ssh
  ports: 443/tcp 80/tcp 7878/tcp 162/udp 22/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  sourceports: 
  icmp-blocks: 
  rich rules: 

Specifically, the ports line tells us that the firewall rule exists and in allowing inbound UDP traffic on port 162:

ports: 443/tcp 80/tcp 7878/tcp 162/udp 22/tcp

If this firewall rule DOES NOT exist, then it can be added by executing the following commands:

firewall-cmd --zone=public --add-port=162/udp
firewall-cmd --zone=public --add-port=162/udp --permanent

Debian

Debian has the iptables firewall installed but not enabled by default. The firewall rules are maintained by the netfilter-persistent service, this is not installed by default. You can determine if it is installed with the following command:

systemctl status netfilter-persistent.service

If you receive this output then there is no firewall service active on your Debian machine:

Unit netfilter-persistent.service could not be found.

This means all inbound traffic is allowed, you will receive SNMP Traps.

If you receive this output then the firewall service is active on your Debian machine:

● netfilter-persistent.service - netfilter persistent configuration
   Loaded: loaded (/lib/systemd/system/netfilter-persistent.service; enabled)
   Active: active (exited) since Tue 2018-11-27 14:24:11 AEDT; 1min 26s ago
 Main PID: 17749 (code=exited, status=0/SUCCESS)

If the netfilter-persistent service is enabled you can now check the status of the firewall:

iptables --list

An open firewall config would produce output like:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination       

You can see no rules exist.

If a rule did exist allowing inbound UDP traffic on port 162 then it would look like this:

target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:snmp-trap

If this firewall rule DOES NOT exist, then it can be added by executing the following command:

iptables -I INPUT -p udp --destination-port 162 -j ACCEPT

Ubuntu

Ubuntu uses the Uncomplicated Firewall (ufw) to manage firewall rules however it is not enabled on a default install. You can check if it is enabled with the following command:

ufw status

IF the firewall is NOT running, it will produce this output:

Status: inactive

IF the firewall is running, it should product output like:

Status: active

If the firewall is NOT running, this means that inbound traffic is allowed (you will receive SNMP Traps).

To ENABLE the firewall on boot and to start it, execute the following command:

ufw enable

Be careful executing this command, you will not be able to access the server when it next reboots as the default configuration is to deny all incoming connections. You will need to add rules for all the different ports connect to this server.

To list the firewall rules execute this command:

ufw status verbose

Which should produce output like:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
162/udp                    ALLOW IN    Anywhere                  
162/udp (v6)               ALLOW IN    Anywhere (v6)   

You can see from the output that firewall rules exists allowing inbound UDP traffic on port 162.

If this firewall rule DOES NOT exist, then it can be added by executing the following commands:

ufw allow snmptrap
ufw reload

Conclusion

With these steps you will be able to confirm that the Nagios server has the correctly firewall rules enable to allow it to receive SNMP Trap UDP traffic on port 162.

Your next troubleshooting step would be to check the snmptrapd service.

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/