iptables configuration - only one port is open

[groob]

Hello!

I went through a lot of tutorials and posts here, but still no luck in solving my problem. So I decided to ask you for help.

I'd like to achieve two things - have SSH available from WAN as well as a range of ports for rtorrent. This means port 22 and i.e. 51777-51800 ports to be open.

My current post-firewall file is:

#!/bin/sh
iptables -D INPUT -j DROP
iptables -A INPUT -p tcp --syn -i "$1" --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 51777:51800 -j ACCEPT
iptables -A INPUT -j DROP

Unfortunately (when testing with http://ping.eu/port-chk/) I can confirm only 22 port to be open. The next line is for some reason ignored.

Could anyone tell me what is wrong here?

[Tamadite]

Is the router the device where you run rtorrent?

[groob]

Yes, rtorrent is launched there.

[Tamadite]

Run

iptables -L INPUT -n -v

and check if the rule is there. The first column will tell you the number of packets that have matched the rule.

[groob]

The output tells me nothing, so I'm pasting it here:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    2   112 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          state INVALID
  13M 2098M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED
16608  995K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0          state NEW
55370   18M ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0          state NEW
    0     0 ACCEPT     2    --  *      *       0.0.0.0/0            224.0.0.0/4
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.0/4        udp dpt:!1900
54315 4182K SECURITY   all  --  vlan1  *       0.0.0.0/0            0.0.0.0/0          state NEW
  139 45592 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0          udp spt:67 dpt:68
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.1        tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp dpt:21
  118  7099 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
 4016  240K ACCEPT     tcp  --  vlan1  *       0.0.0.0/0            0.0.0.0/0          tcp dpt:22 flags:0x16/0x02
49000 3770K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

[Tamadite]

The output tells me nothing, so I'm pasting it here:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    2   112 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          state INVALID
  13M 2098M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED
16608  995K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0          state NEW
55370   18M ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0          state NEW
    0     0 ACCEPT     2    --  *      *       0.0.0.0/0            224.0.0.0/4
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.0/4        udp dpt:!1900
54315 4182K SECURITY   all  --  vlan1  *       0.0.0.0/0            0.0.0.0/0          state NEW
  139 45592 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0          udp spt:67 dpt:68
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.1.1        tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp dpt:21
  118  7099 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
 4016  240K ACCEPT     tcp  --  vlan1  *       0.0.0.0/0            0.0.0.0/0          tcp dpt:22 flags:0x16/0x02
49000 3770K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

try:

iptables -I INPUT -p tcp --dport 51777:51800 -j ACCEPT

[groob]

I'm afraid nothing has changed...
Still only 22 is open.

This is how iptables looks now:

iptables -D INPUT -j DROP

iptables -A INPUT -p tcp --syn -i "$1" --dport 22 -j ACCEPT
iptables -I INPUT -p tcp --dport 51777:51800 -j ACCCEPT

iptables -A INPUT -j DROP

[Tamadite]

Given the INPUT table you showed you should run just the command I gave you. That's why I quoted the INPUT table.

[groob]

I may not understand you clearly.
Do you want me to leave only one coomand in my post-firewall file?