Firewall doesn't allow me to forward ports

pmku · 2021-11-04 02:49:20

Hi everyone, even though I made the iptables accept every request, probably a firewall software on computer doesn't allow me to forward ports. I wish I exactly know what it is

Here is output of tcpdump:
https://pastebin.com/rfWLLK5d

Neither can I ping from another computer

seth · 2021-11-04 08:10:38

I made the iptables accept every request, probably a firewall software on computer doesn't allow me to forward ports.

This is nonsensical.
1. iptables is a netfilter frontend. netfilter *is* *the* (kernel) "firewall" on your (linux) computer and it accepts by default in abll tables. Also what do you mean by "probably"? Is there a "firewall system on computer"?
2. "accept every request", "forward ports" and "can't ping" don't fit together. Why and where do you think you want to forward ports? Is the arch system a NATing router?

Post the output of

sudo iptables -nvL
sudo tcpdump -i enp8s0 icmp # then ping the system

and elaborate on the network layout (is this a virtual machine, are you behind a NATing router/firewall, what are you trying to do itfp)

pmku · 2021-11-06 16:17:47

seth wrote:

I made the iptables accept every request, probably a firewall software on computer doesn't allow me to forward ports.
This is nonsensical.
1. iptables is a netfilter frontend. netfilter *is* *the* (kernel) "firewall" on your (linux) computer and it accepts by default in abll tables. Also what do you mean by "probably"? Is there a "firewall system on computer"?
2. "accept every request", "forward ports" and "can't ping" don't fit together. Why and where do you think you want to forward ports? Is the arch system a NATing router?
Post the output of
sudo iptables -nvL
sudo tcpdump -i enp8s0 icmp # then ping the system
and elaborate on the network layout (is this a virtual machine, are you behind a NATing router/firewall, what are you trying to do itfp)

Thanks for the reply. I'm using NATing router. Not a virtual machine. Router firewall is disabled. I need forwarding for multiple applications or whatever I need at that momont.

https://pastebin.com/Nbn3T4kD

Last edited by pmku (2021-11-06 16:18:19)

seth · 2021-11-06 16:32:07

You're not filtering the tcpdump for icmp packages, the iptables are completely empty so you're neither forwarding, nor blocking stuff and "forwarding for multiple applications or whatever I need at that moment" doesn't really tell what your intentions are.

The netfilter is transient, it only exists in RAM. See https://wiki.archlinux.org/title/Iptabl … _and_usage for the common way to "preserve" (ie. restore) it across boots.

pmku · 2021-11-06 16:59:33

seth wrote:

You're not filtering the tcpdump for icmp packages, the iptables are completely empty so you're neither forwarding, nor blocking stuff and "forwarding for multiple applications or whatever I need at that moment" doesn't really tell what your intentions are.
The netfilter is transient, it only exists in RAM. See https://wiki.archlinux.org/title/Iptabl … _and_usage for the common way to "preserve" (ie. restore) it across boots.

Even though I add rules. For testing purposes
Chain INPUT (policy ACCEPT)
target prot opt source destination
all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
all -- anywhere anywhere
all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
all -- anywhere anywhere

It still doesn't. I'm checking via open port checking websites and making my friend ping my ip.
What I want to do is playing some games that require dedicated server, home web server, ftp server etc. etc.
Isn't it supposed to work when I allow it. I borrowed my friend's laptop and tested it on Windows computer, it worked so nothing is wrong on router side.

loqs · 2021-11-06 17:02:35

Your system has the IP 192.168.1.103? If so that is a private IP address so the router will be performing NAT and it is the router that you need to configure for port forwarding not the Arch installation.

pmku · 2021-11-06 17:21:15

loqs wrote:

Your system has the IP 192.168.1.103? If so that is a private IP address so the router will be performing NAT and it is the router that you need to configure for port forwarding not the Arch installation.

Router is already configured to forward requests coming from my public IP to the device that has private IP of 192.168.1.103 When I turn off the port on the router I can't see any requests on tcpdump

Last edited by pmku (2021-11-06 17:23:00)

seth · 2021-11-06 17:31:27

This has nothing to do w/ your local iptables and you don't have to forward anything in there.
There's obviously some in- and outbound traffic in the tcpdump.
To control the test, please actually run

sudo tcpdump -i enp8s0 icmp

on the system and the try to ping it from the outside and post the resulting traffic.

Are you *sure that the NAT router is configured to forward *all* inbound traffic to that IP or is it restricted to certain ports?

pmku · 2021-11-06 19:27:17

seth wrote:

This has nothing to do w/ your local iptables and you don't have to forward anything in there.
There's obviously some in- and outbound traffic in the tcpdump.
To control the test, please actually run
sudo tcpdump -i enp8s0 icmp
on the system and the try to ping it from the outside and post the resulting traffic.
Are you *sure that the NAT router is configured to forward *all* inbound traffic to that IP or is it restricted to certain ports?

listening on enp8s0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
22:23:21.860493 IP ryzen-go-brr > _gateway: ICMP ryzen-go-brr udp port 49248 unreachable, length 132
22:23:21.869831 IP ryzen-go-brr > _gateway: ICMP ryzen-go-brr udp port 49248 unreachable, length 132
22:23:22.570788 IP ryzen-go-brr > _gateway: ICMP ryzen-go-brr udp port 60611 unreachable, length 134
22:23:23.569851 IP ryzen-go-brr > _gateway: ICMP ryzen-go-brr udp port 60611 unreachable, length 134
22:23:25.560477 IP ryzen-go-brr > _gateway: ICMP ryzen-go-brr udp port 60611 unreachable, length 134
22:23:25.573281 IP ryzen-go-brr > _gateway: ICMP ryzen-go-brr udp port 60611 unreachable, length 134
22:23:29.560473 IP ryzen-go-brr > _gateway: ICMP ryzen-go-brr udp port 60611 unreachable, length 134
22:23:29.568942 IP ryzen-go-brr > _gateway: ICMP ryzen-go-brr udp port 60611 unreachable, length 134
^C
8 packets captured
8 packets received by filter
0 packets dropped by kernel

Tested with and without router firewall enabled. As I said before, it works on every device other than my arch setup.

loqs · 2021-11-06 19:38:17

On the Arch box what is the output of:

ip a
ip r
find /etc/systemd -name \*.service -type l -a -xtype f -printf %f\\n

seth · 2021-11-06 20:25:32

Can you "ping google.com" *from* the archlinux system?

Arch Linux

#1 2021-11-04 02:49:20

Firewall doesn't allow me to forward ports

#2 2021-11-04 08:10:38

Re: Firewall doesn't allow me to forward ports

#3 2021-11-06 16:17:47

Re: Firewall doesn't allow me to forward ports

#4 2021-11-06 16:32:07

Re: Firewall doesn't allow me to forward ports

#5 2021-11-06 16:59:33

Re: Firewall doesn't allow me to forward ports

#6 2021-11-06 17:02:35

Re: Firewall doesn't allow me to forward ports

#7 2021-11-06 17:21:15

Re: Firewall doesn't allow me to forward ports

#8 2021-11-06 17:31:27

Re: Firewall doesn't allow me to forward ports

#9 2021-11-06 19:27:17

Re: Firewall doesn't allow me to forward ports

#10 2021-11-06 19:38:17

Re: Firewall doesn't allow me to forward ports

#11 2021-11-06 20:25:32

Re: Firewall doesn't allow me to forward ports

Board footer