Port not opening

hsnanua · 09-19-2011, 02:33 AM

Hi all,

I cant seem to open my ports with my iptables. I am trying to open port 5900 but somehow it still doesnt.

I am using the ip tables below. I restarted the ip tables, but still telnet refused.

Code:

# Generated by iptables-save v1.3.5 on Thu Dec 16 10:40:00 2010
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [104956494:7410857183]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -d 172.30.232.135 -p tcp -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -d 172.30.232.136 -p tcp -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -s 83.96.144.9 -p tcp -m tcp --dport 3306 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.103.0.0/255.255.0.0 -j ACCEPT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 5900 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2675 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2677 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2135 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 2136 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 47122 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.103.0.0/255.255.0.0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5900 -j ACCEPT
#-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3668 -j ACCEPT

# Allow port 80 only when accessed from the cluster
 -A RH-Firewall-1-INPUT -s 10.103.0.0/255.255.0.0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -s 10.103.0.0/255.255.0.0 -p tcp -m state --state NEW -m tcp --dport 8880 -j ACCEPT

# Only allow port 80 from outside the cluster to the web server
-A RH-Firewall-1-INPUT -d 195.88.18.13 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -d 195.88.18.12 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -d 195.88.18.11 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -d 195.88.18.8  -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
#-A RH-Firewall-1-INPUT -d 195.88.18.8  -p tcp -m state --state NEW -m tcp --dport 47122 -j ACCEPT
-A RH-Firewall-1-INPUT -d 195.88.18.8  -p tcp -m state --state NEW -m tcp --dport 8880 -j ACCEPT

# MySQL access from outside the cluster to the reporting server
-A RH-Firewall-1-INPUT -d 195.88.18.13 -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT

# -A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

-A RH-Firewall-1-INPUT -d 10.103.4.40 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Thu Dec 16 10:40:00 2010
# Generated by iptables-save v1.3.5 on Thu Dec 16 10:40:00 2010
*nat
:PREROUTING ACCEPT [58628481:16860954476]
:POSTROUTING ACCEPT [133127:10110394]
:OUTPUT ACCEPT [34649975:2081168594]
#-A PREROUTING -d 195.88.18.200 -i bond0.18 -p tcp -j DNAT --to-destination 10.103.4.40
-A POSTROUTING -s 10.103.0.0/255.255.0.0 -j MASQUERADE
COMMIT
# Completed on Thu Dec 16 10:40:00 2010

This is what i get

[root@lb-01 sysconfig]# telnet 195.88.18.8 5900
Trying 195.88.18.8...
telnet: connect to address 195.88.18.8: Connection refused

Please help..

Thanks

anomie · 09-19-2011, 08:39 AM

A tcp port is not "open" unless the client host is able to complete a handshake with it. Do you have a telnet daemon listening on tcp 5900?

If you're not sure, post the output of:

Code:

# netstat -ltnp

cendryon · 09-19-2011, 02:29 PM

Hi

Port 5900 is VNC default port, so I'm assuming you want to access your RH box with VNC.
As anomie said, you need both to allow connection to port 5900 in your firewall rules, and to start VNC to handle the connection request behind the firewall.

But before opening port 5900 to the Internet, please read "VNC through SSH tunnel" howto's if you don't want to comprise your RH box : VNC is not a secure protocol.

Cheers