Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have this iptables where all working except tcp/udp port 3478 and 5349.

$ cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Thu Nov 21 10:21:41 2013
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp --dport 3478 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5349 -j ACCEPT
-A INPUT -p udp -m udp --dport 5349 -j ACCEPT
-A INPUT -p udp -m udp --dport 3478 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5222 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5269 -j ACCEPT
-A INPUT -p udp -m udp -m string --dport 5080 -j DROP  --string "friendly-scanner" --algo bm --to 65535 
-A INPUT -p udp -m udp -m string --dport 5060 -j DROP  --string "friendly-scanner" --algo bm --to 65535 
-A INPUT -p tcp -m tcp --dport 5081 -j ACCEPT
-A INPUT -p udp -m udp --dport 5081 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5080 -j ACCEPT
-A INPUT -p udp -m udp --dport 5080 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5061 -j ACCEPT
-A INPUT -p udp -m udp --dport 5061 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5060 -j ACCEPT
-A INPUT -p udp -m udp --dport 5060 -j ACCEPT
-A INPUT -p udp -m udp --dport 16000:42000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 7007 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 22 --state NEW -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -s 178.162.205.224/32 -j DROP
-A INPUT -s 65.55.44.100/32 -j DROP
-A INPUT -s 178.162.205.224/32 -j DROP
-A INPUT -s 91.218.247.162/32 -j DROP
-A INPUT -s 85.25.78.58/32 -j DROP
-A INPUT -s 91.218.247.162/32 -j DROP

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

-A INPUT -j ACCEPT

COMMIT
# Completed on Thu Nov 21 10:21:41 2013
# Generated by webmin
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
# Generated by webmin
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed
share|improve this question
1  
Just to verify that this is the actual running configuration, could you run iptables-save as root? If it is, then it looks like the firewall settings aren't blocking your ports, and you should look at the application configuration. –  Jander Nov 26 '13 at 0:46
add comment

1 Answer

Those rules look pretty open to me. I would verify that those are the rules that are currently in effect on the machine.

Can the clients connect if you flush the tables with all of the policies set to accept?

I assume the clients aren't one of these...

-A INPUT -s 178.162.205.224/32 -j DROP
-A INPUT -s 65.55.44.100/32 -j DROP
-A INPUT -s 178.162.205.224/32 -j DROP
-A INPUT -s 91.218.247.162/32 -j DROP
-A INPUT -s 85.25.78.58/32 -j DROP
-A INPUT -s 91.218.247.162/32 -j DROP
share|improve this answer
    
How do i check logs file of iptables, like who visited and who was blocked etc? –  YumYumYum Nov 26 '13 at 22:46
1  
Those source address matches are at the bottom of the chain, and will never be reached, since the '-j REJECT' immediately before them matches anything. –  Jander Nov 26 '13 at 23:27
    
Nice catch Jander, I didn't notice that. –  canadmos Nov 30 '13 at 6:54
    
YumYumYum, to do that you can write a rule that will log all specified events, with a custom log prefix, to /var/log/messages. Search the following page for --log-level level, which should give you some more information. [link]linux.die.net/man/8/iptables –  canadmos Nov 30 '13 at 7:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.