host prohibited?

qwertyjjj · 09-26-2011, 05:43 AM

I get this for a host I am trying to backup to.
Where can I view prohibited IPs?

Code:

[root myscripts]# ping xxx.xxx.xx.74
PING xxx.xxx.xx.74 (xxx.xxx.xx.74) 56(84) bytes of data.
From xxx.xxx.xx.74 icmp_seq=1 Destination Host Prohibited

acid_kewpie · 09-26-2011, 05:46 AM

there is no such thing. http://en.wikipedia.org/wiki/ICMP_De...on_Unreachable

qwertyjjj · 09-26-2011, 06:52 AM

what do you mean no such thing? It says in the ping reply that it is prohibited.

acid_kewpie · 09-26-2011, 07:12 AM

there no "list" of prohibited IP's. As per the link, host unreachable is a response from the gateway of the subnet of the requested host, maybe check out the reachability of that machine from the router in question.

qwertyjjj · 09-26-2011, 07:38 AM

When I ping it is rejected but when I nmap port 80 it replies.
Also, I have port 20 and 21 open in the iptables but when I nmap port 20, it says it is closed.
This is the iptables script.
Am I missing something?

Code:

# Generated by iptables-save v1.3.5 on Fri Sep 16 04:59:49 2011
*mangle
:PREROUTING ACCEPT [19588:10233482]
:INPUT ACCEPT [19588:10233482]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [18858:10334564]
:POSTROUTING ACCEPT [18858:10334564]
COMMIT
# Completed on Fri Sep 16 04:59:49 2011
# Generated by iptables-save v1.3.5 on Fri Sep 16 04:59:49 2011
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [18851:10333352]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 20 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 21 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 123 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 8002 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 9001 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 8080 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 1935 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Fri Sep 16 04:59:49 2011
# Generated by iptables-save v1.3.5 on Fri Sep 16 04:59:49 2011
*nat
:PREROUTING ACCEPT [1234:59200]
:POSTROUTING ACCEPT [338:21268]
:OUTPUT ACCEPT [338:21268]
COMMIT

acid_kewpie · 09-26-2011, 07:59 AM

well the icmp is clearly going to be rejected, as nothing else matches in the rulebase. I guess that you don't have anything running on port 20 and 21, despite the iptables rules permitting them.