I'm very new to *nix operating systems, and I'm having some trouble which I believe is because of misconfiguration of the iptables firewall.
My server has SSH running on port 22, and server software running on TCP port 25565. SSH and the server software respond appropriately to connections made from inside the network (that is, connections made using the server's local address, 10.0.0.xx). However, if I attempt to access them from outside the network or using the router's external IP address, they do not respond.
The router is configured to forward those ports to the server; I very much doubt there is an error there.
After researching iptables, I tried a few guides, but I am not seeing any results.
The output of iptables -L is as such:
Chain INPUT (policy DROP) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ACCEPT tcp -- anywhere anywhere tcp dpt:25565 ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:27015 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
An nmap scan from inside the network reports that port 22 and 25565 are open, and that ports 80 and 2705 (another server software that I am not running at the moment) are closed. Running nmap with the router's external IP returns no useful results; I believe the router is detecting the scan attempt and refusing to respond.
The server is running Debian in text-only mode.
Does anyone see what the problem is, or have troubleshooting steps to suggest?
In response to comments:
netstat -tpln gives the following (among other things); I assume this is good, though the difference between tcp and tcp6 escapes me.
tcp6 0 0 :::25565 :::* LISTEN 3092/java
Hosts.deny is devoid of entries.
However, /var/auth.log has some... interesting contents. Is it normal for people to start trying to bruteforce my root password the very minute SSH is exposed?
But yes, a perusal of the logs seems to suggest that I'm the only person who cannot SSH into my server.