You are not logged in.

Pages: 1

#1 2012-12-25 17:11:58

runny6play
Member
Registered: 2012-02-18
Posts: 85

iptables still denying input on port when rule added [solved?]

I am trying to open up port  for transmission but after adding the rule its still denyed. well at least according to transmission

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 6985 6115K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    2   120 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     41   --  *      *       0.0.0.0/0            0.0.0.0/0           
   40  2230 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 ctstate NEW
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 ctstate NEW
 1244 87204 UDP        udp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW
  136  7180 TCP        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x17/0x02 ctstate NEW
 1455  105K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-proto-unreachable
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            recent: SET name: TCP-PORTSCAN side: source mask: 255.255.255.255 reject-with tcp-reset
    0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            recent: SET name: UDP-PORTSCAN side: source mask: 255.255.255.255 reject-with icmp-port-unreachable
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:51413
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:51413
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:51413

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 3672 packets, 515K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain TCP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            recent: UPDATE seconds: 60 name: TCP-PORTSCAN side: source mask: 255.255.255.255 reject-with tcp-reset
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:321

Chain UDP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            recent: UPDATE seconds: 60 name: UDP-PORTSCAN side: source mask: 255.255.255.255 reject-with icmp-port-unreachable

Last edited by runny6play (2012-12-25 23:58:57)

Offline

#2 2012-12-25 17:31:00

brebs
Member
Registered: 2007-04-03
Posts: 3,742

Re: iptables still denying input on port when rule added [solved?]

1455  105K REJECT     all

Are you rejecting everything at that point? If so, rules below it are useless, especially rules hoping to accept stuff.

The order of iptables rules is critical.

Offline

#3 2012-12-25 17:36:02

runny6play
Member
Registered: 2012-02-18
Posts: 85

Re: iptables still denying input on port when rule added [solved?]

so I need to have the accept rule before reject?
how do I move the rule up? I can't find the reject rule in my iptables.conf
is a matter of moving it above it?
I'm a little new to iptables

Last edited by runny6play (2012-12-25 17:45:31)

Offline

#4 2012-12-25 17:56:12

runny6play
Member
Registered: 2012-02-18
Posts: 85

Re: iptables still denying input on port when rule added [solved?]

still not working 

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 5370 4814K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:51413
10916 8427K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     41   --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 ctstate NEW
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 ctstate NEW
  394 25578 UDP        udp  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW
    1    60 TCP        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x17/0x02 ctstate NEW
  395 25638 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-proto-unreachable
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            recent: SET name: TCP-PORTSCAN side: source mask: 255.255.255.255 reject-with tcp-reset
    0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            recent: SET name: UDP-PORTSCAN side: source mask: 255.255.255.255 reject-with icmp-port-unreachable

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 16167 packets, 8953K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain TCP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            recent: UPDATE seconds: 60 name: TCP-PORTSCAN side: source mask: 255.255.255.255 reject-with tcp-reset
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:321

Chain UDP (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            recent: UPDATE seconds: 60 name: UDP-PORTSCAN side: source mask: 255.255.255.255 reject-with icmp-port-unreachable
# Generated by iptables-save v1.4.16.3 on Tue Dec 25 11:06:28 2012
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [355:38221]
:TCP - [0:0]
:UDP - [0:0]
-A INPUT -p tcp -m tcp --dport 51413 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p ipv6 -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A INPUT -p tcp -m recent --set --name TCP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with tcp-reset
-A INPUT -p udp -m recent --set --name UDP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with icmp-port-unreachable
-A TCP -p tcp -m recent --update --seconds 60 --name TCP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with tcp-reset
-A TCP -p tcp -m tcp --dport 321 -j ACCEPT

-A UDP -p udp -m recent --update --seconds 60 --name UDP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Tue Dec 25 11:06:28 2012

Last edited by runny6play (2012-12-25 17:59:35)

Offline

#5 2012-12-25 19:27:22

brebs
Member
Registered: 2007-04-03
Posts: 3,742

Re: iptables still denying input on port when rule added [solved?]

You've created chains with the names TCP and UDP - that's a very confusing thing to do wink

Can use this rule to recognize torrent traffic, I think:

-m conntrack --ctorigsrcport 51413

Edit: Read an iptables tutorial or two.

Last edited by brebs (2012-12-25 19:28:46)

Offline

#6 2012-12-25 20:14:43

runny6play
Member
Registered: 2012-02-18
Posts: 85

Re: iptables still denying input on port when rule added [solved?]

brebs wrote:

You've created chains with the names TCP and UDP - that's a very confusing thing to do wink

Can use this rule to recognize torrent traffic, I think:

-m conntrack --ctorigsrcport 51413

Edit: Read an iptables tutorial or two.

I have. I set up this firewall according to the simple statefull firewall arch wiki guide. I added the port rule to spefications and it's still not working.
it won't accept the traffic

Offline

#7 2012-12-25 23:58:38

runny6play
Member
Registered: 2012-02-18
Posts: 85

Re: iptables still denying input on port when rule added [solved?]

turns out it was just transmission being horrible

Offline

#8 2012-12-26 00:05:25

cfr
Member
From: Cymru
Registered: 2011-11-27
Posts: 7,178

Re: iptables still denying input on port when rule added [solved?]

I used the same tutorial so my config has the same "confusing names". (I didn't find it especially confusing when setting it up but maybe it is in the longer term.)

I'm just curious: I though iptables handled only ipv4 traffic so what does the rule dealing with ipv6 do in this context?

CLI Paste | How To Ask Questions

Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L

Offline

#9 2012-12-26 00:52:46

runny6play
Member
Registered: 2012-02-18
Posts: 85

Re: iptables still denying input on port when rule added [solved?]

cfr wrote:

I used the same tutorial so my config has the same "confusing names". (I didn't find it especially confusing when setting it up but maybe it is in the longer term.)

I'm just curious: I though iptables handled only ipv4 traffic so what does the rule dealing with ipv6 do in this context?

I went back and reread the guide. their so that you may open ports later on without having to worry about early rejection rules. and something about port scanning prevention.
It doesn't could you point that rule out to me? I can't find it

Offline

#10 2012-12-26 00:55:52

cfr
Member
From: Cymru
Registered: 2011-11-27
Posts: 7,178

Re: iptables still denying input on port when rule added [solved?]

Not sure what you're asking. You have:

-A INPUT -p ipv6 -j ACCEPT
runny6play wrote:

turns out it was just transmission being horrible

Could you say how you solved it for other users? This comment isn't likely to be much help!

Last edited by cfr (2012-12-26 00:57:14)

CLI Paste | How To Ask Questions

Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L

Offline

Pages: 1

Board footer

Powered by FluxBB