4

I'm having some trouble to allow TeamViewer in a restrictive iptables configuration. I'm running Fedora 20.

After some research I found out TeamViewer uses ports 80, 443 and I have created this script to set up rules to allow those ports to be open but it still doesn't work:

#!/bin/bash
#clear iptables
iptables -F
iptables -X

#accept everything no matter port on localhost
iptables -A INPUT -i lo -j ACCEPT

#allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#allow traffic going to specific outbound ports
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --sport 80 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --sport 443 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 5938 -j ACCEPT
iptables -A INPUT -p tcp --sport 5938 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --sport 53 -j ACCEPT

iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT

#drop anything that doesn't match the rules above
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
iptables -A FORWARD -j DROP

With these rules I can access other machines with TeamViewer but I cannot have others access my machine. Also, when the default (boot) iptables are in place, I can receive and initiate TeamViewer connection.

What am I missing?

EDIT 1

I just ran a packet trace and I can see loads of traffic going on on port 5938 but the PC connecting just says Connecting... and is not prompted for the password.

EDIT 2

I enabled the default set of rules which works and ran another packet trace and now I see that after a connection and some traffic going on on port 5938, I see a HTTP connection (port 80) being established to a TeamViewer server and before that I see a couple of DNS (port 53) requests for TeamViewer host names. All these ports are open in my restrictive setup yet I don't see the DNS requests and the HTTP connection... :-/ Connection to other hosts and sites works just fine. Actually I'm posting this EDIT using the restrictive set of rules.

EDIT 3 Just for peace of mind I removed the last three DROP rules and like this it works.

  • Does TeamViewer keep logs? (Those might narrow the issue.) – Anko Sep 1 '14 at 21:41
  • It does keep some logs but as far as I can see there is nothing very useful in them as to troubleshoot this problem. – Fabricio Sep 1 '14 at 21:57
  • Is this ruleset for a TeamViewer client or server? – Creek Sep 1 '14 at 22:29
  • It's a client... and a server... :-) TeamViewer is a remote access tool which connects via TeamViewer's services. The same locally installed software enables you to access remote machines and be accessed by remote machines. As I said in the question, from this Fedora box, with the given ipchains rules, I can access other systems running TeamViewer but other systems cannot access it. – Fabricio Sep 2 '14 at 6:00
1

I list You my configuration of iptables with working TeamViewer:

    #!/bin/bash

#--------------------------------------
#Clear iptables
iptables -F -t nat
iptables -X -t nat
iptables -F -t filter
iptables -X -t filter

#allow forward
echo '1' > /proc/sys/net/ipv4/ip_forward

#default policy
iptables -P INPUT DROP
iptables -P FORWARD DROP 
iptables -P OUTPUT DROP


#accept related and established connection
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# DNS
iptables -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT

# interfejs LO
iptables -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT

#WWW
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

#TEAMVIEWER
iptables -A OUTPUT -o eth0 -p tcp --dport 5938 -m state --state NEW -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.