Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here. |
Notices |
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
Are you new to LinuxQuestions.org? Visit the following links:
Site Howto |
Site FAQ |
Sitemap |
Register Now
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
|
 |
|
07-04-2005, 10:06 AM
|
#1
|
Member
Registered: Sep 2004
Location: western massachusetts
Distribution: fedora core 3, Suse 10
Posts: 877
Rep:
|
Testing port 6881....NAT Error - error in Azureus
hi im trying to get azureus set up and when i test the port it is set to by default to use i get this message
Testing port 6881....NAT Error
i think i need to open port 6881. I believe i enabled the firewall when i installed fc3 but im not sure how to manipulate it. Im not asking how to do it specifically i just need some direction. Im not sure if i have to look into selinux or iptables? any replies would be appreciated. thanks in advance.
|
|
|
07-04-2005, 11:05 AM
|
#2
|
LQ Guru
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870
|
i don't know about selinux, but as far as iptables is concerned just do a:
Code:
iptables -I INPUT -p TCP --dport 6881:6999 -m state --state NEW -j ACCEPT
this command assumes you are running azureus on the firewalled box itself...
if you are filtering outgoing packets you'd need to add a similar rule to the OUTPUT chain...
http://dessent.net/btfaq/#ports
|
|
|
10-31-2005, 03:33 PM
|
#3
|
Member
Registered: Sep 2004
Location: western massachusetts
Distribution: fedora core 3, Suse 10
Posts: 877
Original Poster
Rep:
|
for the longest time the command worked like a charm. However now when i do it i still get a nat error from azureus. So im not positive what it could be.
|
|
|
10-31-2005, 11:44 PM
|
#4
|
LQ Guru
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870
|
please post the output of (when you get the error): what about your log file? what does it show at the time of the error??
Code:
tail -f /var/log/syslog
|
|
|
11-01-2005, 07:09 AM
|
#5
|
Member
Registered: Sep 2004
Location: western massachusetts
Distribution: fedora core 3, Suse 10
Posts: 877
Original Poster
Rep:
|
i have no syslog with that absolute path. this is what i get when i search for it.
Code:
[root@localhost jeff]# find / -name syslog
/etc/rc.d/init.d/syslog
/etc/logrotate.d/syslog
/etc/sysconfig/syslog
/var/lock/subsys/syslog
/usr/share/doc/ruby-libs-1.8.3/ext/syslog
/media/slave/etc/logrotate.d/syslog
/media/slave/etc/sysconfig/syslog
/media/slave/etc/rc.d/init.d/syslog
media/slave is a mount point for hdb so those are safe entries to ignore. The rub libs one seems like another entry that could be ignored. Which one should i look at?
Code:
[root@localhost jeff]# /sbin/iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpts:6881:6999 state NEW
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT ipv6-crypt-- anywhere anywhere
ACCEPT ipv6-auth-- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:5353
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Code:
[root@localhost jeff]# /sbin/iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
what does the -L stand for in the command? list?
|
|
|
11-01-2005, 07:15 AM
|
#6
|
LQ Guru
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870
|
as for the syslog file, make sure you are indeed running the syslog daemon:
Code:
ps aux | grep syslogd
as for you iptables rules, being that your INPUT policy is set to ACCEPT, all of your ACCEPT rules are pointless...
i'm not sure what's going on with your Azureus... have you tried disabling selinux to see if it helps??
|
|
|
11-01-2005, 07:32 PM
|
#7
|
Member
Registered: Sep 2004
Location: western massachusetts
Distribution: fedora core 3, Suse 10
Posts: 877
Original Poster
Rep:
|
yeah the syslog daemon is running. I'll have to look up a tutorial on iptables so i understand it more so that i can use it to allow Azureus to run without disabling selinux. I am not sure how to disable selinux but i'd rather try to find a better solution then that. i can still download using azureus with the nat error but my smiley icons for azureus are never green when i have the nat error.
|
|
|
11-01-2005, 08:45 PM
|
#8
|
LQ Guru
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870
|
Quote:
Originally posted by dr_zayus69
yeah the syslog daemon is running. I'll have to look up a tutorial on iptables so i understand it more so that i can use it to allow Azureus to run without disabling selinux.
|
except that you are already allowing ALL traffic through your firewall, so there's nothing more you could "allow" as far as iptables is concerned...
Quote:
I am not sure how to disable selinux but i'd rather try to find a better solution then that. i can still download using azureus with the nat error but my smiley icons for azureus are never green when i have the nat error.
|
if the issue is indeed being caused by selinux, then nothing else you do will help you... if i were you i'd temporarily disable the selinux protection and see if it does the trick, then at least you'd know where you stand and you could then proceed to find the proper configuration you need to apply to selinux for your azureus... i don't know anything about selinux, but this would be a start if you wanna temporarily disable it:
http://www.google.com/search?q=disable+selinux
|
|
|
11-01-2005, 08:57 PM
|
#9
|
Member
Registered: Sep 2004
Location: western massachusetts
Distribution: fedora core 3, Suse 10
Posts: 877
Original Poster
Rep:
|
Quote:
Originally posted by win32sux
except that you are already allowing ALL traffic through your firewall, so there's nothing more you could "allow" as far as iptables is concerned... 
|
and you see why i need a tutorial on iptables. lol
|
|
|
11-01-2005, 09:58 PM
|
#10
|
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
|
Actually the last rule in the RH-Firewall-1-INPUT chain is usually a clean-up rule with a REJECT target so all packets that make it to that point get rejected before they get to the default input chain policy. I don't see the rule you added in the output of iptables -L, so I'd take a guess that your system rebooted at some point and the firewall reset to the original Fedora Core default. Try re-running the rule posted above (iptables -I INPUT -p TCP --dport 6881:6999 -m state --state NEW -j ACCEPT) and see if azureus works. If so, then do "service iptables save" so that the change will be persistant over reboots.
|
|
|
11-01-2005, 10:54 PM
|
#11
|
LQ Guru
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870
|
thanks for the heads-up Capt_Caveman... i overlooked the REJECT rule at the end of the RH chain... having said that, the 6881:6999/tcp rules does show-up:
Quote:
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpts:6881:6999 state NEW
|
|
|
|
11-02-2005, 06:27 AM
|
#12
|
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
|
Quote:
Originally posted by win32sux
having said that, the 6881:6999/tcp rules does show-up:
|
Thanks, I stand corrected  . In that case, you may want to completely rule out the firewall by temporarily disabling it with the command "service iptables stop" and then retry azureus. Make sure to restart it after testing with "service iptables start".
May also want to verify that your ISP hasn't started filtering those ports. Try using a free online security scanner to verify that they are indeed open. There are a number of scanners available, including ones at grc.com and sygate SOS.
|
|
|
11-02-2005, 08:01 AM
|
#13
|
Member
Registered: Sep 2004
Location: western massachusetts
Distribution: fedora core 3, Suse 10
Posts: 877
Original Poster
Rep:
|
yeah it works fine when i do /sbin/service iptables stop but after exiting it and starting iptables back up it gets the nat error message again. i haven't scanned any ports yet tho. i don't understand the 6999 in the command i know the first number is the port but why is the 6999 there? is it declaring a range of ports? I would change the port but then i wouldn't know what i needed to do to change the iptables command. To be honest i had this post bookmarked and would just copy and paste the command when i used azureus so i didn't completely understand it. Recently i'd use ctrl+r to do a reverse lookup of the command in the shell to get it back up to enter it again. And thought about putting it in a shell script to execute when i started azureus or have it execute with the startup scripts. My basic understanding is that it opens up the port to allow for communication. Thanks for the help so far.
|
|
|
11-02-2005, 11:45 AM
|
#14
|
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658
Rep:
|
Ok, that would indicate it's a firewall issue then. Looking over the Azureus user guide, it appears that it only uses port 6881 now and uses both tcp and udp protocols. Try adding these rules:
iptables -I INPUT -p tcp --dport 6881 -j ACCEPT
iptables -I INPUT -p udp --dport 6881 -j ACCEPT
|
|
|
11-02-2005, 07:21 PM
|
#15
|
LQ Guru
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870
|
yeah i think you are right, Capt_Caveman... i actually had no idea that bittorret used udp packets, i thought it was all tcp... but now i read through this azureus faq: http://azureus.aelitis.com/wiki/inde...PortForwarding and yeah it says it will use both tcp and udp on the same port (it also says azureus only needs one port)... that would explain why an error would be obtained even though things seemed to still be working fine i think... like, it was just complaining about the udp packets not getting through and stuff... i think...
|
|
|
All times are GMT -5. The time now is 11:35 PM.
|
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
|
Latest Threads
LQ News
|
|