iptable quirk?

Jukas · 09-23-2005, 03:24 PM

According to the man page, I should be able to specify multiple protocols with one line.. i.e

$IPTABLES -A INPUT -p ALL --dport 143 -j ACCEPT

However iptables gives me the following error:

Quote:

iptables v1.3.3: Unknown arg `--destination-port'
Try `iptables -h' or 'iptables --help' for more information.

However if I write it like

$IPTABLES -A INPUT -p tcp --dport 143 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 143 -j ACCEPT

It doesn't give errors. I'm trying to troubleshoot an instance where I can't connect to courier-imap on 143 via Outlook Express 6x when the firewall is in place, but I can if I flush all existing rules.

The firewall I currently have in place is

Quote:

#!/bin/bash
#Change the part after the = to the where you IPTABLES is on your system
IPTABLES=/sbin/iptables

#flush existing rules
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p icmp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p tcp
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p udp
$IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 25 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 110 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 110 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 143 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 143 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 783 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 783 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 993 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 993 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 6900:6910 -j ACCEPT
$IPTABLES -A INPUT -p tcp -s 216.229.107.32 --dport 3306 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 20 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 21 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 22 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 25 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 110 -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport 110 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 143 -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport 143 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 783 -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport 783 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp --dport 993 -j ACCEPT
$IPTABLES -A OUTPUT -p udp --dport 993 -j ACCEPT
$IPTABLES -A INPUT -p tcp -j REJECT
$IPTABLES -A INPUT -p ICMP -j DROP
#$IPTABLES -A INPUT -m limit --limit 3/second --limit-burst 5 -i ! lo -j LOG
$IPTABLES -A INPUT -i ! lo -j DROP

And with it in place I can't reach the courier-imap service via Outlook Express (but I can from a straight telnet window). I've narrowed it down to something in the firewall blocking it, but am stuck there at the moment.

Mara · 09-23-2005, 04:46 PM

Not all protocols have ports. -p all includes ICMP, which is one of them. That's why --dport (and --sport) option doesn't work with it.

Which port is your Cuourier listening at? Are you sure it's 143?

Jukas · 09-23-2005, 05:09 PM

Quote:

Originally posted by Mara
Not all protocols have ports. -p all includes ICMP, which is one of them. That's why --dport (and --sport) option doesn't work with it.

Which port is your Cuourier listening at? Are you sure it's 143?

Well that explains teh dport quirk on the firewall. I'm positive Courier-imap is listing on 143 I can telnet to the host on that port from an outside box and I get the:

* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT THRE
AD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] Courier-IMAP ready. Copyr
ight 1998-2004 Double Precision, Inc. See COPYING for distribution information.

Further, if I ssh into the debian box and flush the iptables I can check the mailbox via Outlook Express no problem. If I re-enable my rc.firewall I get the "Your mail server has not responded in 60 seconds" error.

Mara · 09-24-2005, 03:17 PM

Unblock ICMP for a moment. The error message you get may change to something clearer.

Jukas · 09-24-2005, 05:18 PM

Quote:

Originally posted by Mara
Unblock ICMP for a moment. The error message you get may change to something clearer.

Soon as I do that, I can check it fine with M$ Outlook Express. Now the question is both why does OE require sending an ICMP packet to check IMAP email but not pop3, and how can I allow it access without opening ICMP to everything.