I'm having some trouble to allow TeamViewer in a restrictive iptables configuration. I'm running Fedora 20.
After some research I found out TeamViewer uses ports 80, 443 and I have created this script to set up rules to allow those ports to be open but it still doesn't work:
#!/bin/bash #clear iptables iptables -F iptables -X #accept everything no matter port on localhost iptables -A INPUT -i lo -j ACCEPT #allow established connections iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #allow traffic going to specific outbound ports iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --sport 80 -j ACCEPT iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT iptables -A INPUT -p tcp --sport 443 -j ACCEPT iptables -A OUTPUT -p tcp --dport 5938 -j ACCEPT iptables -A INPUT -p tcp --sport 5938 -j ACCEPT iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT iptables -A INPUT -p tcp --sport 53 -j ACCEPT iptables -A OUTPUT -p udp --dport 53 -j ACCEPT iptables -A INPUT -p udp --sport 53 -j ACCEPT #drop anything that doesn't match the rules above iptables -A INPUT -j DROP iptables -A OUTPUT -j DROP iptables -A FORWARD -j DROP
With these rules I can access other machines with TeamViewer but I cannot have others access my machine. Also, when the default (boot) iptables are in place, I can receive and initiate TeamViewer connection.
What am I missing?
I just ran a packet trace and I can see loads of traffic going on on port 5938 but the PC connecting just says Connecting... and is not prompted for the password.
I enabled the default set of rules which works and ran another packet trace and now I see that after a connection and some traffic going on on port 5938, I see a HTTP connection (port 80) being established to a TeamViewer server and before that I see a couple of DNS (port 53) requests for TeamViewer host names. All these ports are open in my restrictive setup yet I don't see the DNS requests and the HTTP connection... :-/ Connection to other hosts and sites works just fine. Actually I'm posting this EDIT using the restrictive set of rules.
EDIT 3 Just for peace of mind I removed the last three DROP rules and like this it works.