Testing port 6881....NAT Error

dr_zayus69 · 07-04-2005, 09:06 AM

hi im trying to get azureus set up and when i test the port it is set to by default to use i get this message

Testing port 6881....NAT Error

i think i need to open port 6881. I believe i enabled the firewall when i installed fc3 but im not sure how to manipulate it. Im not asking how to do it specifically i just need some direction. Im not sure if i have to look into selinux or iptables? any replies would be appreciated. thanks in advance.

win32sux · 07-04-2005, 10:05 AM

i don't know about selinux, but as far as iptables is concerned just do a:

Code:

iptables -I INPUT -p TCP --dport 6881:6999 -m state --state NEW -j ACCEPT

this command assumes you are running azureus on the firewalled box itself...

if you are filtering outgoing packets you'd need to add a similar rule to the OUTPUT chain...

http://dessent.net/btfaq/#ports

dr_zayus69 · 10-31-2005, 02:33 PM

for the longest time the command worked like a charm. However now when i do it i still get a nat error from azureus. So im not positive what it could be.

win32sux · 10-31-2005, 10:44 PM

please post the output of (when you get the error):

Code:

iptables -L

Code:

iptables -L -t nat

what about your log file? what does it show at the time of the error??

Code:

tail -f /var/log/syslog

dr_zayus69 · 11-01-2005, 06:09 AM

i have no syslog with that absolute path. this is what i get when i search for it.

Code:

[root@localhost jeff]# find / -name syslog
/etc/rc.d/init.d/syslog
/etc/logrotate.d/syslog
/etc/sysconfig/syslog
/var/lock/subsys/syslog
/usr/share/doc/ruby-libs-1.8.3/ext/syslog
/media/slave/etc/logrotate.d/syslog
/media/slave/etc/sysconfig/syslog
/media/slave/etc/rc.d/init.d/syslog

media/slave is a mount point for hdb so those are safe entries to ignore. The rub libs one seems like another entry that could be ignored. Which one should i look at?

Code:

[root@localhost jeff]# /sbin/iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:6881:6999 state NEW
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     ipv6-crypt--  anywhere             anywhere
ACCEPT     ipv6-auth--  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:5353
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

Code:

[root@localhost jeff]# /sbin/iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

what does the -L stand for in the command? list?

win32sux · 11-01-2005, 06:15 AM

as for the syslog file, make sure you are indeed running the syslog daemon:

Code:

 ps aux | grep syslogd

as for you iptables rules, being that your INPUT policy is set to ACCEPT, all of your ACCEPT rules are pointless...

i'm not sure what's going on with your Azureus... have you tried disabling selinux to see if it helps??

dr_zayus69 · 11-01-2005, 06:32 PM

yeah the syslog daemon is running. I'll have to look up a tutorial on iptables so i understand it more so that i can use it to allow Azureus to run without disabling selinux. I am not sure how to disable selinux but i'd rather try to find a better solution then that. i can still download using azureus with the nat error but my smiley icons for azureus are never green when i have the nat error.

win32sux · 11-01-2005, 07:45 PM

Quote:

Originally posted by dr_zayus69
yeah the syslog daemon is running. I'll have to look up a tutorial on iptables so i understand it more so that i can use it to allow Azureus to run without disabling selinux.

except that you are already allowing ALL traffic through your firewall, so there's nothing more you could "allow" as far as iptables is concerned...

Quote:

I am not sure how to disable selinux but i'd rather try to find a better solution then that. i can still download using azureus with the nat error but my smiley icons for azureus are never green when i have the nat error.

if the issue is indeed being caused by selinux, then nothing else you do will help you... if i were you i'd temporarily disable the selinux protection and see if it does the trick, then at least you'd know where you stand and you could then proceed to find the proper configuration you need to apply to selinux for your azureus... i don't know anything about selinux, but this would be a start if you wanna temporarily disable it:

http://www.google.com/search?q=disable+selinux

dr_zayus69 · 11-01-2005, 07:57 PM

Quote:

Originally posted by win32sux
except that you are already allowing ALL traffic through your firewall, so there's nothing more you could "allow" as far as iptables is concerned...

and you see why i need a tutorial on iptables. lol

Capt_Caveman · 11-01-2005, 08:58 PM

Actually the last rule in the RH-Firewall-1-INPUT chain is usually a clean-up rule with a REJECT target so all packets that make it to that point get rejected before they get to the default input chain policy. I don't see the rule you added in the output of iptables -L, so I'd take a guess that your system rebooted at some point and the firewall reset to the original Fedora Core default. Try re-running the rule posted above (iptables -I INPUT -p TCP --dport 6881:6999 -m state --state NEW -j ACCEPT) and see if azureus works. If so, then do "service iptables save" so that the change will be persistant over reboots.

win32sux · 11-01-2005, 09:54 PM

thanks for the heads-up Capt_Caveman... i overlooked the REJECT rule at the end of the RH chain... having said that, the 6881:6999/tcp rules does show-up:

Quote:

Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpts:6881:6999 state NEW

Capt_Caveman · 11-02-2005, 05:27 AM

Quote:

Originally posted by win32sux
having said that, the 6881:6999/tcp rules does show-up:

Thanks, I stand corrected

. In that case, you may want to completely rule out the firewall by temporarily disabling it with the command "service iptables stop" and then retry azureus. Make sure to restart it after testing with "service iptables start".

May also want to verify that your ISP hasn't started filtering those ports. Try using a free online security scanner to verify that they are indeed open. There are a number of scanners available, including ones at grc.com and sygate SOS.

dr_zayus69 · 11-02-2005, 07:01 AM

yeah it works fine when i do /sbin/service iptables stop but after exiting it and starting iptables back up it gets the nat error message again. i haven't scanned any ports yet tho. i don't understand the 6999 in the command i know the first number is the port but why is the 6999 there? is it declaring a range of ports? I would change the port but then i wouldn't know what i needed to do to change the iptables command. To be honest i had this post bookmarked and would just copy and paste the command when i used azureus so i didn't completely understand it. Recently i'd use ctrl+r to do a reverse lookup of the command in the shell to get it back up to enter it again. And thought about putting it in a shell script to execute when i started azureus or have it execute with the startup scripts. My basic understanding is that it opens up the port to allow for communication. Thanks for the help so far.

Capt_Caveman · 11-02-2005, 10:45 AM

Ok, that would indicate it's a firewall issue then. Looking over the Azureus user guide, it appears that it only uses port 6881 now and uses both tcp and udp protocols. Try adding these rules:

iptables -I INPUT -p tcp --dport 6881 -j ACCEPT
iptables -I INPUT -p udp --dport 6881 -j ACCEPT

win32sux · 11-02-2005, 06:21 PM

yeah i think you are right, Capt_Caveman... i actually had no idea that bittorret used udp packets, i thought it was all tcp... but now i read through this azureus faq: http://azureus.aelitis.com/wiki/inde...PortForwarding and yeah it says it will use both tcp and udp on the same port (it also says azureus only needs one port)... that would explain why an error would be obtained even though things seemed to still be working fine i think... like, it was just complaining about the udp packets not getting through and stuff... i think...