iptables configuration - only one port is open

Printable View

11-08-2010, 01:33
groob

iptables configuration - only one port is open

Hello!

I went through a lot of tutorials and posts here, but still no luck in solving my problem. So I decided to ask you for help.

I'd like to achieve two things - have SSH available from WAN as well as a range of ports for rtorrent. This means port 22 and i.e. 51777-51800 ports to be open.

My current post-firewall file is:

Code:

#!/bin/sh iptables -D INPUT -j DROP iptables -A INPUT -p tcp --syn -i "$1" --dport 22 -j ACCEPT iptables -A INPUT -p tcp --dport 51777:51800 -j ACCEPT iptables -A INPUT -j DROP

Unfortunately (when testing with http://ping.eu/port-chk/) I can confirm only 22 port to be open. The next line is for some reason ignored.

Could anyone tell me what is wrong here?
12-08-2010, 22:46
Tamadite

Is the router the device where you run rtorrent?
12-08-2010, 22:57
groob

Yes, rtorrent is launched there.
12-08-2010, 23:06
Tamadite

Run

Code:

iptables -L INPUT -n -v

and check if the rule is there. The first column will tell you the number of packets that have matched the rule.
12-08-2010, 23:09
groob

The output tells me nothing, so I'm pasting it here:

Code:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 2 112 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 13M 2098M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 16608 995K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 55370 18M ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 ACCEPT 2 -- * * 0.0.0.0/0 224.0.0.0/4 0 0 ACCEPT udp -- * * 0.0.0.0/0 224.0.0.0/4 udp dpt:!1900 54315 4182K SECURITY all -- vlan1 * 0.0.0.0/0 0.0.0.0/0 state NEW 139 45592 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.1 tcp dpt:80 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 118 7099 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 4016 240K ACCEPT tcp -- vlan1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 49000 3770K DROP all -- * * 0.0.0.0/0 0.0.0.0/0
14-08-2010, 16:55
Tamadite

Quote:

Originally Posted by groob

The output tells me nothing, so I'm pasting it here:

Code:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 2 112 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 13M 2098M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 16608 995K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 55370 18M ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 ACCEPT 2 -- * * 0.0.0.0/0 224.0.0.0/4 0 0 ACCEPT udp -- * * 0.0.0.0/0 224.0.0.0/4 udp dpt:!1900 54315 4182K SECURITY all -- vlan1 * 0.0.0.0/0 0.0.0.0/0 state NEW 139 45592 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.1 tcp dpt:80 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 118 7099 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 4016 240K ACCEPT tcp -- vlan1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 49000 3770K DROP all -- * * 0.0.0.0/0 0.0.0.0/0

try:

Code:

iptables -I INPUT -p tcp --dport 51777:51800 -j ACCEPT
14-08-2010, 17:04
groob

I'm afraid nothing has changed...
Still only 22 is open.

This is how iptables looks now:

Code:

iptables -D INPUT -j DROP iptables -A INPUT -p tcp --syn -i "$1" --dport 22 -j ACCEPT iptables -I INPUT -p tcp --dport 51777:51800 -j ACCCEPT iptables -A INPUT -j DROP
14-08-2010, 18:03
Tamadite

Given the INPUT table you showed you should run just the command I gave you. That's why I quoted the INPUT table.
14-08-2010, 18:08
groob

I may not understand you clearly.
Do you want me to leave only one coomand in my post-firewall file?
14-08-2010, 18:34
Tamadite

Do what it takes to get again the INPUT table you showed on your previous post and then try the command I gave you.
14-08-2010, 18:47
groob

Ok, so now I have this:

Code:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:51777:51800 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 1028K 1136M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 553 33180 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 4153 1286K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 ACCEPT 2 -- * * 0.0.0.0/0 224.0.0.0/4 0 0 ACCEPT udp -- * * 0.0.0.0/0 224.0.0.0/4 udp dpt:!1900 678 74677 SECURITY all -- vlan1 * 0.0.0.0/0 0.0.0.0/0 state NEW 2 656 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.1 tcp dpt:80 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 6 364 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 1 60 ACCEPT tcp -- vlan1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 563 64703 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
14-08-2010, 19:14
Tamadite

Quote:

Originally Posted by groob

Ok, so now I have this:

Code:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:51777:51800 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 1028K 1136M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 553 33180 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 state NEW 4153 1286K ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 ACCEPT 2 -- * * 0.0.0.0/0 224.0.0.0/4 0 0 ACCEPT udp -- * * 0.0.0.0/0 224.0.0.0/4 udp dpt:!1900 678 74677 SECURITY all -- vlan1 * 0.0.0.0/0 0.0.0.0/0 state NEW 2 656 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.1.1 tcp dpt:80 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 6 364 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 1 60 ACCEPT tcp -- vlan1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02 563 64703 DROP all -- * * 0.0.0.0/0 0.0.0.0/0

As it is now, TCP traffic coming into the WAN port with destination ports 51777 to 51800 will be accepted to reach the router on LAN router's IP. You should see fields pkts and bytes increasing a long as it already has happened on the SSH port (1 pkts 60 bytes). If this does not happen it means you are not getting TCP traffic on the WAN port with destination ports 51777 to 51800.
14-08-2010, 19:18
groob

Thank you! You are right, it is increasing. Currently I see:

Code:

9 836 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:51777:51800

Now I need to ask a question - how to make this condition pernament?

BTW - why port test keeps reporting any of 51777:51800 as closed?