LinuxQuestions.org
Visit Jeremy's Blog.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 04-05-2004, 01:35 PM   #1
RedHatMN
Member
 
Registered: Mar 2001
Distribution: RedHat 9
Posts: 110

Rep: Reputation: 15
IPTables and Fedora Core


I have the following line in /etc/sysconfig/iptables

"-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5432 -j ACCEPT"

I restart the firewall and then run nmap on the port that's supposed to be open, why is it still showing up as closed? Is there something I'm missing?

[root@wookie root]# nmap -p 5432 localhost

Starting nmap 3.48 ( http://www.insecure.org/nmap/ ) at 2004-04-05 13:36 CDT
Interesting ports on wookie (127.0.0.1):
PORT STATE SERVICE
5432/tcp closed postgres

Nmap run completed -- 1 IP address (1 host up) scanned in 0.397 seconds
[root@wookie root]#
 
Old 04-06-2004, 02:18 AM   #2
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
One thing to keep in mind is that nmaping localhost can give you inaccurate scan results. If you scan from another system, do you still see the same reuslts (the app may listen on your network IP rather than the loopback). If you temporarily shut off the firewall and then do the scan, does it still report it as closed? If it's still closed, then it's not your firewall and is likely a network problem or the application isn't running properly.

If it reports it as open when you turned off the firewall, how did you add that rule? Directly editing the /etc/sysconfig/iptables file can cause problems. Also make sure that you have a line in your iptables rules that allows connections in the ESTABLISHED,RELATED state as well. If both those are OK, then post a copy of the entire iptables file or the output of iptables -L -v (make sure to remove any identifiable ip addresses).
 
Old 04-06-2004, 07:55 AM   #3
RedHatMN
Member
 
Registered: Mar 2001
Distribution: RedHat 9
Posts: 110

Original Poster
Rep: Reputation: 15
[root@wookie root]# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
11 1121 RH-Firewall-1-INPUT all -- any any anywhere anywhere

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 RH-Firewall-1-INPUT all -- any any anywhere anywhere

Chain OUTPUT (policy ACCEPT 13 packets, 928 bytes)
pkts bytes target prot opt in out source destination

Chain RH-Firewall-1-INPUT (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
0 0 ACCEPT icmp -- any any anywhere anywhere icmp any
0 0 ACCEPT ipv6-crypt-- any any anywhere anywhere
' 0 0 ACCEPT ipv6-auth-- any any anywhere anywhere
9 828 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- any any anywhere anywhere

state NEW tcp dptostgres
0 0 ACCEPT tcp -- any any anywhere anywhere

state NEW tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:http
0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpts:netbios-ns:netbios-ssn
2 293 REJECT all -- any any anywhere anywhere reject-with icmp-host-prohibited
 
Old 04-06-2004, 08:08 AM   #4
Half_Elf
LQ Guru
 
Registered: Sep 2001
Location: Montreal, Canada
Distribution: Slackware; Debian; Gentoo...
Posts: 2,163

Rep: Reputation: 46
if the port is CLOSED instead of FIREWALLED, it often says there's no service working on the port.
 
Old 04-06-2004, 08:09 AM   #5
RedHatMN
Member
 
Registered: Mar 2001
Distribution: RedHat 9
Posts: 110

Original Poster
Rep: Reputation: 15
So maybe the PostgreSQL service that's supposed to be accepting connections on that port is configured incorrectly?
 
Old 04-06-2004, 11:49 AM   #6
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
Firewall looks ok. Did you try temporarily stoppping the firewall:
service iptables stop

Then nmap or use one of those free internet sites that will do a nmap or nmap-like scan. I know www.grc.com and sygate both offer those services free.

Also check the output of netstat -pantu. Specifically look for a PostgreSQL entry on port 5432.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Help on IPTABLES on Fedora Core 4 Firewall jun_tuko Linux - Security 3 10-20-2005 02:43 PM
Uninstalling iptables in Fedora Core 1 jdthebigj Red Hat 3 02-06-2005 08:23 AM
IPTABLES with Fedora Core 3 richpri Fedora 2 12-30-2004 07:23 AM
Fedora Core 2 iptables troubles scardali Linux - Networking 5 11-17-2004 02:29 PM
iptables in Linux Fedora Core 2 qbsu21th Fedora 1 10-20-2004 10:00 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 10:43 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration