KeepLearning's questions

I've got OpenVPN on Amazon Linux 2 EC2 instance and need to forward packets through it. It works until I start docker on the instance. Then the FORWARD policy turns to DROP and VPN stops working.

[root@ip-... ~]# iptables -L FORWARD
Chain FORWARD (policy ACCEPT)                             <<< See it's ACCEPT
target     prot opt source               destination         

Then I start docker and check again:

[root@ip-... ~]# systemctl start docker

[root@ip-... ~]# iptables -L
Chain FORWARD (policy DROP)                               <<<< Turned to DROP
target     prot opt source               destination         
DOCKER-USER  all  --  anywhere             anywhere            
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

I tried to set the policy in /etc/sysconfig/iptables but that doesn't help.

This seems specific to Amazon Linux 2, I don't seem to have this problem on Ubuntu.

Any ideas?

I have inherited a number of EC2 instances with Centos that authenticate users against AWS Directory Service through LDAP. Now I need to run some manual queries with ldapsearch using the same account to debug some authentication problems. However the password is encrypted in the config, like this:

[sssd]
domains = LDAP
services = nss, pam

[domain/LDAP]
id_provider = ldap
cache_credentials = True

ldap_schema = AD
ldap_uri = ldaps://...
ldap_search_base = ...
ldap_default_bind_dn = ...
ldap_default_authtok = AAAQAB3QDeZ7+...cBSpT0ZABu4AAQID
ldap_default_authtok_type = obfuscated_password

Is there any way to decrypt / de-obfuscate the ldap_default_authtok? I don't want to change it in AD because it's being used on many servers.