I have a set of iptables rules (see below) whose purpose is to disallow traffic to go out of my machine when my VPN connection is abruptly lost or manually terminated:#!/bin/bashecho Please wait a moment......echo Save original iptables. Apply new iptables rulesiptables-save > /home/username/vpn/iptables.saveiptables -A INPUT -m conntrack -j DROP --ctstate INVALIDiptables -A INPUT -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPTiptables -A INPUT -p tcp -m tcp -m conntrack -s 123.123.123.123 -i eth0 --sport 443 -j ACCEPT  --ctstate ESTABLISHED #ca1.confiptables -A OUTPUT -p tcp -m tcp -m conntrack -d 123.123.123.123 -o eth0 --dport 443 -j ACCEPT --ctstate NEW,ESTABLISHED #ca1.confiptables -A INPUT -i eth0 -j DROPiptables -A OUTPUT -o eth0 -j REJECTiptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 80 -j ACCEPT  --ctstate NEW,ESTABLISHEDiptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 443 -j ACCEPT  --ctstate NEW,ESTABLISHEDiptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 53 -j ACCEPT  --ctstate NEW,ESTABLISHEDiptables -A OUTPUT -p tcp -m tcp -m conntrack -o tun0 --dport 53 -j ACCEPT  --ctstate NEW,ESTABLISHEDiptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 80 -j ACCEPT  --ctstate ESTABLISHEDiptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 443 -j ACCEPT  --ctstate ESTABLISHEDiptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 53 -j ACCEPT  --ctstate ESTABLISHEDiptables -A INPUT -p tcp -m tcp -m conntrack -i tun0 --sport 53 -j ACCEPT  --ctstate ESTABLISHEDiptables -A FORWARD -i eth0 -o tun0 -j ACCEPTiptables -A FORWARD -i tun0 -o eth0 -j ACCEPTiptables -A FORWARD -j DROPThe above iptables rules work on a machine running an Intel Haswell CPU (i7-4xxx series, quad-core, 8 threads) and a Haswell chipset (H87 series).However they do not work on a machine running an Intel Ivy-Bridge CPU (i7-3xxx series, quad-core, 8 threads) and an Ivy-Bridge chipset (H77 series).Could someone tell me why?The OS that is being used is Debian Wheezy and the same HDD is used for the above experiment.
iptables rules' weird behavior
iptables;vpn
It's highly unlikely to be related to the CPU chipset. It's more likely to be related to the NIC.If you're sharing the same hard disk and OS installation between two different machines, the NIC will be different so the MAC for that NIC will be different. Therefore it will almost certainly be bound on configuration to eth0 but to eth1 on the other.You can fix this on Wheezy by editing /etc/udev/rules.d/70-persistent-net.rules and ensuring that both generated rules name the interface as eth0. (Just make sure you don't ever try to have a single machine with both NICs.)Here is the appropriate entry from my system. Your systems' MACs will be different. This line instructs udevd to give the NIC with MAC 00:0a:cd:20:aa:3f the name eth0:# PCI device 0x10ec:/sys/devices/pci0000:00/0000:00:04.0/0000:02:00.0 (r8169)SUBSYSTEM==net, ACTION==add, DRIVERS==?*, ATTR{address}==00:0a:cd:20:aa:3f, ATTR{dev_id}==0x0, ATTR{type}==1, KERNEL==eth*, NAME=eth0