Can't open new ports anymore

Synt4x_3rr0r · 05-04-2009, 05:35 AM

I have a server which acts like a router and it's been working great for a long time now. But some time ago I noticed that some of my ports weren't working anymore and I couldn't open them up again either.
Neither can I open any other port that I've tried. What's so strange is that default ports like 21, 80 etc are still open. But it isn't only the default ports that work, because I have SSH on port 2223 and that still works. And I've tried using torrents on port 42-44 but they wont open either.

Here's my iptables -vL:

Code:

Chain INPUT (policy ACCEPT 259 packets, 14925 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 2366 3519K ACCEPT     all  --  eth1   any     anywhere             anywhere            
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ftp 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpts:11000:11020 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:2223 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpts:22346:22355 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:smtp 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:imap 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:9999 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:19999 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  eth1   any     anywhere             anywhere            
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  any    any     192.168.1.14         anywhere            tcp dpts:italk:12355 
    0     0 ACCEPT     tcp  --  any    any     192.168.1.4          anywhere            tcp dpt:22345 

Chain OUTPUT (policy ACCEPT 675 packets, 995K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1197 66256 ACCEPT     all  --  any    eth1    anywhere             anywhere

And here is the script I'm using for the iptables rules. It's my distros startup script. Oh and btw, eth0 is the external connection and eth1 is the internal:

Code:

#!/bin/sh

# /etc/conf.d/local.start
# Put the things you want to run on boot here.

echo 1 > /proc/sys/net/ipv4/conf/all/forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Set up basic iptables rules:
/usr/sbin/iptables -F FORWARD
/usr/sbin/iptables -F -t nat
/usr/sbin/iptables -P FORWARD DROP
/usr/sbin/iptables -A FORWARD -i eth1 -j ACCEPT
/usr/sbin/iptables -A INPUT -i eth1 -j ACCEPT
/usr/sbin/iptables -A OUTPUT -o eth1 -j ACCEPT
/usr/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
/usr/sbin/iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

##########################
# Port forwarding:       #
##########################
# eth1:
#
# Torrent
/usr/sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 12345:12355 -j DNAT --to-destination 192.168.1.14
/usr/sbin/iptables -A FORWARD -s 192.168.1.14 -p tcp --dport 12345:12355 -j ACCEPT

/usr/sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 22345 -j DNAT --to-destination 192.168.1.4
/usr/sbin/iptables -A FORWARD -s 192.168.1.4 -p tcp --dport 22345 -j ACCEPT

##########################
#
# eth0:
#
# FTP
/usr/sbin/iptables -A INPUT -p tcp --dport 21 -j ACCEPT

# FTP Passive
/usr/sbin/iptables -A INPUT -p tcp --dport 11000:11020 -j ACCEPT

# HTTP
/usr/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# SSH
/usr/sbin/iptables -A INPUT -p tcp --dport 2223 -j ACCEPT

# Torrent
/usr/sbin/iptables -A INPUT -p tcp --dport 22346:22355 -j ACCEPT

# SMTP & IMAP
/usr/sbin/iptables -A INPUT -p tcp --dport 25 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 143 -j ACCEPT

# Webmin & Usermin
/usr/sbin/iptables -A INPUT -p tcp --dport 9999 -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport 19999 -j ACCEPT

Of all these ports, these are the ones that still work: 21, 80, 2223, 25, 143, 9999, 19999. None of the port forwarding stuff works. Neither does the passive ftp ports and torrent ports. And if I try to open another port, it doesn't actually open. It will show up in iptables -vL, but according to canyouseeme.org it's still closed.
Have I configured something wrong? But it did work before which is odd. I think I'm going crazy over this.

Synt4x_3rr0r · 05-07-2009, 05:33 PM

Any advice at all?

anomie · 05-07-2009, 06:02 PM

The rules you posted (with iptables -vL) do not seem to match what your script is doing. As an example, in the script you set the FORWARD chain policy to DROP, but in the iptables output listing that is clearly not there.

The issue you're describing is a little complicated, so I would get it down to a base case to try to eliminate possibilities. Add an iptables rule to open tcp port 6969 on your input chain. Then, on the server, run the command:

$ nc -l 6969 <-- your syntax to set up a listener may differ slightly; check the nc(1) manpages

Then, on your client workstation, run the command:

$ nc -zvw 1 server.ip.here 6969

What does that say? If the connection fails, double check your iptables rule and double check (with netstat) that you set up the listener properly on the server.

Synt4x_3rr0r · 05-10-2009, 11:21 AM

Hi. Thanks for your reply. And sorry for my late reply. I haven't been at home.

OK so I tried what you said and this is what it says on my laptop which is connected to my wireless AP on the network:

Code:

192.168.1.1: inverse host lookup failed: Unknown host
(UNKNOWN) [192.168.1.1] 6969 (?) : Connection refused

That seems odd. I also tried it on my workstation which is connected by wire directly to the gateway(which is also the firewall that has the problems) and it says this instead:

Code:

synt4x.ath.cx [192.168.1.1] 6969: Connection refused

I have added the gateway server's IP address and hostname to /etc/hosts on my workstation so that might be why it says that instead. The hostname on the firewall is synt4x.ath.cx, perhaps I can't have that hostname since it has two dots?

Then I tried to connect from an outside computer and it tells me this:

Code:

c-82-209-179-159.cust.bredband2.com [82.209.179.159] 6969 (?) : Connection refused

I have double checked the things you told me. Interestingly port 6969 does NOT show up with netstat -L. I'm not an iptables expert or anything, but this is what I did to open port 6969:

Code:

iptables -A INPUT -p tcp --dport 6969 -j ACCEPT

That is correct right? It is listed when I run iptables -vL like the rest of the ports.

Code:

    1    60 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:6969

I hope this information is good enough to maybe point you in the right direction. Otherwise tell me what I should do to provide that information.

I have written a simple script that resets my firewall to the default settings used in the startup script that I have used since reboot. Maybe there's something wrong with that?

Code:

#!/bin/sh
echo "Stopping firewall and allowing everyone..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

echo "Setting up forwarding..."
iptables -F FORWARD
iptables -F -t nat
iptables -P FORWARD ACCEPT
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

echo "Opening standard ports..."
#eth0
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp --dport 11000:11020 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 2223 -j ACCEPT
iptables -A INPUT -p tcp --dport 22346:22355 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 143 -j ACCEPT
iptables -A INPUT -p tcp --dport 9999 -j ACCEPT
iptables -A INPUT -p tcp --dport 19999 -j ACCEPT
#eth1
iptables -t nat -A PREROUTING -i eth1 -p tcp -m tcp --dport 12345:12355 -j DNAT --to-destination 192.168.1.14
iptables -A FORWARD -s 192.168.1.14 -p tcp -m tcp --dport 12345:12355 -j ACCEPT
/usr/sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 22345 -j DNAT --to-destination 192.168.1.4
/usr/sbin/iptables -A FORWARD -s 192.168.1.4 -p tcp --dport 22345 -j ACCEPT
#iptables -t nat -A PREROUTING -i eth1 -p udp -m udp --dport 43919 -j DNAT --to-destination 192.168.1.3
#iptables -A FORWARD -s 192.168.1.3 -p udp -m udp --dport 43919 -j ACCEPT
#iptables -t nat -A PREROUTING -i eth1 -p udp -m udp --dport 24201 -j DNAT --to-destination 192.168.1.3
#iptables -A FORWARD -s 192.168.1.3 -p udp -m udp --dport 24201 -j ACCEPT

anomie · 05-11-2009, 04:12 PM

Quote:

Originally Posted by Synt4x_3rr0r

Interestingly port 6969 does NOT show up with netstat -L.

The command $ netstat -ltn should show that nc is listening on tcp port 6969. If it doesn't, the rest of the test is not going to work. See my last post about how to set up the listener.

It looks like you added the iptables rule correctly, BTW.

Synt4x_3rr0r · 05-11-2009, 04:29 PM

Hmm it doesn't show up anyway. I AM supposed to run netcat on the firewall, right? :S

Actually it wouldn't matter since it doesn't show up as listening on ANY of my computers. I ran nc -l 6969 on all three of my computers and then checked with netstat -ltn on all of them but it didn't show up on any of them. The laptop is running Ubuntu and the other two computers are running my own distro Enlisy.

Edit:
This is what shows up on the firewall:

Code:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:58594           0.0.0.0:*               LISTEN
tcp        0      0 192.168.1.1:1033        0.0.0.0:*               LISTEN
tcp        0      0 82.209.179.159:11020    0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:40300           0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:2223            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:50683           0.0.0.0:*               LISTEN
tcp        0      0 :::113                  :::*                    LISTEN

anomie · 05-11-2009, 04:31 PM

Check the nc(1) manpages. Some versions require -l -p (rather than just -l).

Point is: this test is not going to work until you get nc listening. Once you've done so, keep the terminal open (if you kill it with Ctrl+C, the listener dies along with it.)

Synt4x_3rr0r · 05-11-2009, 04:41 PM

Ah, yes. there it is. It shows up now

And interestingly, canyouseeme.com says the port is open as well.

Edit: oh sorry, forgot about the nc -zvw 1 stuff. It still says connection refused...

Edit2: I'm kind of wondering though why my laptop says "192.168.1.1: inverse host lookup failed: Unknown host" when I'm trying to connect on it :S

Edit3: I tried again from my workstation and it says the port is open!! I also added the firewall to my laptops /etc/hosts and it also says the port is open.

anomie · 05-12-2009, 12:54 AM

Is the original problem resolved at this point?

Synt4x_3rr0r · 05-12-2009, 04:35 AM

Ah, hehe sorry. I guess I should have mentioned that.
No it still doesn't work. The torrent ports doesn't show up with netstat -ltn and neither does the passive ftp ports(except for port 11020 for some reason), and some other ports. I'm beginning to think that it's the applications that doesn't listen on the ports correctly or something. But the weird thing is that it has worked in the past, and I can't remember that i did anything to break it.

Synt4x_3rr0r · 05-14-2009, 12:31 PM

Sorry for bumping, but the problem hasn't been resolved yet. I'm beginning to think that it might be the applications there is something wrong with, since obviously I can open the ports and get things listening on it, seeing as canyouseeme.com said the port was open when I told netcat to listen on it.

So some applications do listen on the ports, but most do not it seems. That is likely the current problem and not a firewall problem at this point. Any advice?