You are not logged in.
For years, I have used the following rule to connect to mosh from my dynamic ip address:
/usr/bin/iptables -A dynamichosts -s ($MY_DYNAMIC_IP)/32 -p udp -m multiport --dport 60000:61000 -j ACCEPT
Recently, I started getting this error when connecting to mosh:
mosh: Nothing received from server on UDP port 60004. [To quit: Ctrl-^ .]
If I add a rule that doesn’t specify my source IP, I can connect, i.e.
/usr/bin/iptables -A dynamichosts -p udp -m multiport --dport 60000:61000 -j ACCEPT
What has changed and how can I specify my ip address in the iptables rule now? Oddly, the other rules specifying my IP still work, e.g.
/usr/bin/iptables -A dynamichosts -s ($MY_DYNAMIC_IP)//32 -p tcp --dport 22 -j ACCEPT
still allows me to connect to port 22.
Offline
You can add a log rule at the end of the chain "dynamichosts" (and before explicitly denying the packets):
iptables -A dynamichosts -j LOG --log-prefix "dynamichosts unmatched: "
and analyze the logs.
Offline
Thanks. Here is the log of an unsuccessful connection (with the iptables rule specifying source IP):
Jun 26 16:16:10 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=60 TOS=0x10 PREC=0x20 TTL=48 ID=61711 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0
Jun 26 16:16:10 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61712 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=502 RES=0x00 ACK URGP=0
Jun 26 16:16:10 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=73 TOS=0x10 PREC=0x20 TTL=48 ID=61713 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=502 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:10 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61714 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=502 RES=0x00 ACK URGP=0
Jun 26 16:16:10 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=1556 TOS=0x10 PREC=0x20 TTL=48 ID=61715 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=502 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:10 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61717 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=1260 TOS=0x10 PREC=0x20 TTL=48 ID=61718 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61719 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=493 RES=0x00 ACK URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61720 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=493 RES=0x00 ACK URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=68 TOS=0x10 PREC=0x20 TTL=48 ID=61721 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=96 TOS=0x10 PREC=0x20 TTL=48 ID=61722 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61723 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61724 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=120 TOS=0x10 PREC=0x20 TTL=48 ID=61725 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=424 TOS=0x10 PREC=0x20 TTL=48 ID=61726 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=832 TOS=0x10 PREC=0x20 TTL=48 ID=61727 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:11 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=164 TOS=0x10 PREC=0x20 TTL=48 ID=61728 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:12 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61729 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK URGP=0
Jun 26 16:16:12 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61730 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK URGP=0
Jun 26 16:16:12 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=484 TOS=0x10 PREC=0x20 TTL=48 ID=61731 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:12 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=88 TOS=0x10 PREC=0x20 TTL=48 ID=61732 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK PSH URGP=0
Jun 26 16:16:12 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61733 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK URGP=0
Jun 26 16:16:12 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=200 TOS=0x10 PREC=0x20 TTL=48 ID=61734 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK PSH FIN URGP=0
Jun 26 16:16:12 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=52 TOS=0x10 PREC=0x20 TTL=48 ID=61735 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=501 RES=0x00 ACK URGP=0
Offline
It seems to be an issue with the multiport part of the rule. This works:
/usr/bin/iptables -A dynamichosts -s ($MY_DYNAMIC_IP)/32 -p udp --dport 60000 -j ACCEPT
Never mind, this is wrong.
Last edited by rhodie (2023-06-26 21:42:01)
Offline
Jun 26 16:16:10 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=60 TOS=0x10 PREC=0x20 TTL=48 ID=61711 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0
Your source IP tries to connect to port 22. I'm not familiar with mosh - but according to their website this is to be expected.
Are connects to port 22 allowed? To be precise - are they allowed before passing through "dynamichosts"?
Last edited by -thc (2023-06-27 05:30:26)
Offline
rhodie wrote:Jun 26 16:16:10 $HOSTNAME kernel: dynamichosts unmatched: IN=eth0 OUT= MAC=00:25:22:cb:77:3b:58:8b:f3:d3:4d:f2:08:00 SRC=$IP DST=192.168.0.2 LEN=60 TOS=0x10 PREC=0x20 TTL=48 ID=61711 DF PROTO=TCP SPT=35208 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0
Your source IP tries to connect to port 22. I'm not familiar with mosh - but according to their website this is to be expected.
Are connects to port 22 allowed? To be precise - are they allowed before passing through "dynamichosts"?
Yes, and oddly they work fine with source IP specified, i.e.
iptables -A dynamichosts -s ($MY_DYNAMIC_IP)//32 -p tcp --dport 22 -j ACCEPT
More info: I have several arch servers, and the ones that I have updated recently all show the same behavior. I may be able to figure out which package it was that caused the change by looking at pacman history and/or updating the other servers one package at a time.
Offline
Yes, and oddly they work fine with source IP specified
Then they should not have been logged - something's not right here.
More info: I have several arch servers, and the ones that I have updated recently all show the same behavior. I may be able to figure out which package it was that caused the change by looking at pacman history and/or updating the other servers one package at a time.
You can use
cat /var/log/pacman.log | grep -i upgraded
Last edited by -thc (2023-06-27 14:30:53)
Offline
rhodie wrote:Yes, and oddly they work fine with source IP specified
Then they should not have been logged - something's not right here.
That log snippet was for a mosh connection, i.e., `mosh user@host`. Nothing is logged for an ssh connection, i.e., `ssh user@host`.
Offline
Yeah - I got that.
Since mosh starts with a ssh connect and there's an allow rule for ssh in place - the trigger of the log rule is unexpected.
And most likely the cause for the mosh connect issue.
Offline
Ah, gotcha.
Here are the packages upgraded from one of the servers. I think it must be one of these that is causing the issue:
[2023-06-16T12:47:26-0400] [ALPM] upgraded ncurses (6.4-1 -> 6.4_20230520-1)
[2023-06-16T12:47:26-0400] [ALPM] upgraded bash (5.1.016-3 -> 5.1.016-4)
[2023-06-16T12:47:27-0400] [ALPM] upgraded openssl (3.0.8-1 -> 3.1.1-1)
[2023-06-16T12:47:27-0400] [ALPM] upgraded libnghttp2 (1.53.0-1 -> 1.54.0-1)
[2023-06-16T12:47:27-0400] [ALPM] upgraded util-linux-libs (2.39-1 -> 2.39-9)
[2023-06-16T12:47:27-0400] [ALPM] upgraded libxcrypt (4.4.33-1 -> 4.4.35-1)
[2023-06-16T12:47:27-0400] [ALPM] upgraded pam (1.5.3-1 -> 1.5.3-3)
[2023-06-16T12:47:27-0400] [ALPM] upgraded bind (9.18.14-1 -> 9.18.15-1)
[2023-06-16T12:47:27-0400] [ALPM] upgraded systemd-libs (253.4-1 -> 253.5-1)
[2023-06-16T12:47:27-0400] [ALPM] upgraded ca-certificates-mozilla (3.89.1-1 -> 3.90-1)
[2023-06-16T12:47:27-0400] [ALPM] upgraded curl (8.1.1-1 -> 8.1.2-1)
[2023-06-16T12:47:28-0400] [ALPM] upgraded binutils (2.40-5 -> 2.40-6)
[2023-06-16T12:47:28-0400] [ALPM] upgraded dbus (1.14.6-2 -> 1.14.8-1)
[2023-06-16T12:47:28-0400] [ALPM] upgraded diffutils (3.9-1 -> 3.10-1)
[2023-06-16T12:47:28-0400] [ALPM] upgraded libsysprof-capture (3.48.0-1 -> 3.48.0-2)
[2023-06-16T12:47:28-0400] [ALPM] upgraded glib2 (2.76.2-1 -> 2.76.3-1)
[2023-06-16T12:47:28-0400] [ALPM] upgraded grub (2:2.06.r499.ge67a551a4-1 -> 2:2.06.r499.ge67a551a4-2)
[2023-06-16T12:47:29-0400] [ALPM] upgraded hwdata (0.370-1 -> 0.371-1)
[2023-06-16T12:47:29-0400] [ALPM] upgraded iputils (20221126-1 -> 20221126-2)
[2023-06-16T12:47:29-0400] [ALPM] upgraded kbd (2.5.1-2 -> 2.6.0-1)
[2023-06-16T12:47:29-0400] [ALPM] upgraded util-linux (2.39-1 -> 2.39-9)
[2023-06-16T12:47:29-0400] [ALPM] upgraded systemd (253.4-1 -> 253.5-1)
[2023-06-16T12:47:30-0400] [ALPM] upgraded mkinitcpio (35.2-1 -> 36-1)
[2023-06-16T12:47:33-0400] [ALPM] upgraded linux-lts (6.1.29-1 -> 6.1.34-1)
[2023-06-16T12:47:33-0400] [ALPM] upgraded nettle (3.9-1 -> 3.9.1-1)
[2023-06-16T12:47:33-0400] [ALPM] upgraded openssh (9.3p1-1 -> 9.3p1-2)
[2023-06-16T12:47:34-0400] [ALPM] upgraded perl (5.36.1-1 -> 5.36.1-2)
[2023-06-16T12:47:34-0400] [ALPM] upgraded postfix (3.8.0-1 -> 3.8.1-2)
[2023-06-16T12:47:35-0400] [ALPM] upgraded python (3.11.3-1 -> 3.11.3-2)
[2023-06-16T12:47:35-0400] [ALPM] upgraded systemd-sysvcompat (253.4-1 -> 253.5-1)
[2023-06-16T12:47:35-0400] [ALPM] upgraded vim-runtime (9.0.1572-1 -> 9.0.1628-1)
[2023-06-16T12:47:35-0400] [ALPM] upgraded vim (9.0.1572-1 -> 9.0.1628-1)
[2023-06-16T12:47:36-0400] [ALPM] upgraded xfsprogs (6.2.0-1 -> 6.3.0-1)
Offline
With a virtual Arch server (non-LTS kernel, updates as of today) I couldn't reproduce your mosh/iptables behavior.
Can you check first if your servers still show this behavior with all updates (as of today) installed?
Offline
Yes, same behavior.
Here is the output of iptables -L -n:
Chain INPUT (policy ACCEPT)
target prot opt source destination
dynamichosts 0 -- 0.0.0.0/0 0.0.0.0/0
firewall 0 -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 firewall 0 -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Chain dynamichosts (1 references)
target prot opt source destination
ACCEPT 6 -- $DESKTOP_IP 0.0.0.0/0 tcp dpt:22
ACCEPT 6 -- $DESKTOP_IP 0.0.0.0/0 tcp dpt:2812
ACCEPT 17 -- $DESKTOP_IP 0.0.0.0/0 multiport dports 60000:61000
ACCEPT 6 -- $LAPTOP_IP 0.0.0.0/0 tcp dpt:2812
ACCEPT 6 -- $LAPTOP_IP 0.0.0.0/0 tcp dpt:22
ACCEPT 17 -- $LAPTOP_IP 0.0.0.0/0 multiport dports 60000:61000
Chain firewall (2 references)
target prot opt source destination
ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0
ACCEPT 1 -- 0.0.0.0/0 0.0.0.0/0 icmptype 255
ACCEPT 0 -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT 6 -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
ACCEPT 17 -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53
ACCEPT 6 -- $OTHER_SERVER_IP 0.0.0.0/0 tcp dpt:22
REJECT 0 -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
And here is /etc/iptables/iptables.rules (it's a nameserver):
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:dynamichosts - [0:0]
-A INPUT -j dynamichosts
-A dynamichosts -m tcp -p tcp -s $DESKTOP_IP --dport 22 -j ACCEPT
-A dynamichosts -m tcp -p tcp -s $LAPTOP_IP --dport 22 -j ACCEPT
:firewall - [0:0]
-A INPUT -j firewall
-A FORWARD -j firewall
-A firewall -i lo -j ACCEPT
-A firewall -p icmp --icmp-type any -j ACCEPT
-A firewall -m state --state ESTABLISHED,RELATED -j ACCEPT
-A firewall -m tcp -p tcp --dport 53 -j ACCEPT
-A firewall -m udp -p udp --dport 53 -j ACCEPT
-A firewall -m tcp -p tcp -s $SERVER_IP --dport 22 -j ACCEPT
-A firewall -j REJECT --reject-with icmp-host-prohibited
COMMIT
Then there's a cronjob that runs to drop the $DESKTOP_IP and $LAPTOP_IP rules and add new ones for ports 22, 2812, and 60000-61000 if their current values change.
Offline
The ruleset looks O.K. to me. There seems to be no reason for mosh to be unable to connect.
Offline
It seems to have to do with my internet connection. I tried moshing in from another location and it worked fine.
Offline
I also tried downgrading openssh and openssl to see if those changes were the cause of the issue, but it made no difference.
Offline