4

I'm having some trouble to allow TeamViewer in a restrictive iptables configuration. I'm running Fedora 20.

After some research I found out TeamViewer uses ports 80, 443 and I have created this script to set up rules to allow those ports to be open but it still doesn't work:

#!/bin/bash
#clear iptables
iptables -F
iptables -X

#accept everything no matter port on localhost
iptables -A INPUT -i lo -j ACCEPT

#allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#allow traffic going to specific outbound ports
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --sport 80 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --sport 443 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 5938 -j ACCEPT
iptables -A INPUT -p tcp --sport 5938 -j ACCEPT

iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --sport 53 -j ACCEPT

iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT

#drop anything that doesn't match the rules above
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
iptables -A FORWARD -j DROP

With these rules I can access other machines with TeamViewer but I cannot have others access my machine. Also, when the default (boot) iptables are in place, I can receive and initiate TeamViewer connection.

What am I missing?

EDIT 1

I just ran a packet trace and I can see loads of traffic going on on port 5938 but the PC connecting just says Connecting... and is not prompted for the password.

EDIT 2

I enabled the default set of rules which works and ran another packet trace and now I see that after a connection and some traffic going on on port 5938, I see a HTTP connection (port 80) being established to a TeamViewer server and before that I see a couple of DNS (port 53) requests for TeamViewer host names. All these ports are open in my restrictive setup yet I don't see the DNS requests and the HTTP connection... :-/ Connection to other hosts and sites works just fine. Actually I'm posting this EDIT using the restrictive set of rules.

EDIT 3 Just for peace of mind I removed the last three DROP rules and like this it works.

Improve this question
4
  • Does TeamViewer keep logs? (Those might narrow the issue.)
    – Anko
    Commented Sep 1, 2014 at 21:41
  • It does keep some logs but as far as I can see there is nothing very useful in them as to troubleshoot this problem.
    – Fabricio
    Commented Sep 1, 2014 at 21:57
  • Is this ruleset for a TeamViewer client or server?
    – Creek
    Commented Sep 1, 2014 at 22:29
  • It's a client... and a server... :-) TeamViewer is a remote access tool which connects via TeamViewer's services. The same locally installed software enables you to access remote machines and be accessed by remote machines. As I said in the question, from this Fedora box, with the given ipchains rules, I can access other systems running TeamViewer but other systems cannot access it.
    – Fabricio
    Commented Sep 2, 2014 at 6:00

1 Answer 1

Reset to default
2

I list You my configuration of iptables with working TeamViewer:

    #!/bin/bash

#--------------------------------------
#Clear iptables
iptables -F -t nat
iptables -X -t nat
iptables -F -t filter
iptables -X -t filter

#allow forward
echo '1' > /proc/sys/net/ipv4/ip_forward

#default policy
iptables -P INPUT DROP
iptables -P FORWARD DROP 
iptables -P OUTPUT DROP


#accept related and established connection
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# DNS
iptables -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT

# interfejs LO
iptables -A INPUT -i lo -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -o lo -d 127.0.0.1 -j ACCEPT

#WWW
iptables -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

#TEAMVIEWER
iptables -A OUTPUT -o eth0 -p tcp --dport 5938 -m state --state NEW -j ACCEPT
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .