[SOLVED] idiot firewall (i think) question

johnh10000 · 11-23-2009, 02:29 AM

Well I'm trying to get nx to work, I thought, check out ssh locally first.
However I get this. the router port is open. I have changed services. What have I forgoten?

Code:

root@tux:/etc# iptables -A INPUT -p tcp --destination-port 92 -j ACCEPT
root@tux:/etc# iptables -A INPUT -p udp --destination-port 92 -j ACCEPT
root@tux:/etc# iptables -A OUTPUT -p tcp --source-port 92 -j ACCEPT
root@tux:/etc# iptables -A OUTPUT -p udp --source-port 92 -j ACCEPT
root@tux:/etc# ssh tux.isa-geek.org
ssh: connect to host tux.isa-geek.org port 92: Connection refused

chiragrk · 11-23-2009, 05:26 AM

Is there anything configured to listen on port 92? Do a `netstat -antp | grep 92` and see if there's really anything on this port. "connection refused" need not _always_ be because of iptables settings.

linuxlover.chaitanya · 11-23-2009, 05:33 AM

If you have configured iptables set to accept only the configured connections and the default policy is set to reject, then you will have to explicitly accept the ssh connections.
The other reason could be that ssh service is not running. Start it and see it makes any difference.
Also see if you have tcpwrappers configured to deny or accept the ssh connections.
Look at /etc/hosts.allow and /etc/hosts.deny files.

zhjim · 11-23-2009, 05:34 AM

I bet on the two OUTPUT lines. I doubt that your origin will be from the 92 port when you connect to a ssh server on a nother machine.
Also tweakable in the kernel normaly outgoing connections take on a random port between 1024:65535.
Try this one

Code:

root@tux:/etc# iptables -A INPUT -p tcp --destination-port 92 -j ACCEPT
root@tux:/etc# iptables -A INPUT -p udp --destination-port 92 -j ACCEPT
root@tux:/etc# iptables -A OUTPUT -p tcp --destination-port 92 -j ACCEPT
root@tux:/etc# iptables -A OUTPUT -p udp --destination-port 92 -j ACCEPT

If you changed the service in /etc/servicesyou could also go along with

Code:

root@tux:/etc# iptables -A OUTPUT -p udp --destination-port ssh -j ACCEPT

Cheers Zhjim

johnh10000 · 11-23-2009, 06:57 AM

<Embarressed> Stupid me! My try installing ssh BEFORE trying to connect to it!

Sorry for bothering you all.