2

My iptables.conf looks roughly like this:

-A INPUT -p tcp --dport 65000 -j ACCEPT
-A INPUT -j DROP

My sshd_config looks like this:

Port 22
Port 65000
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

My goal is to open only port 65000 to outside world, while I have port 22 opened to my LAN.

I tested this setup using canyouseeme.org on port 65000 and I can't connect to my machine at all, unless I add the following rule:

-A INPUT -p tcp --dport 22 -j ACCEPT

Then I can connect at port 65000.

What is going on? Why did I have to open port 22 to be able to connect on port 65000?

As requested, here is my full configuration:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       5.10.83.0/25         0.0.0.0/0           
 1040  146K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:25
    1    60 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:110
   11   640 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
    1    40 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:60000:60020
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:60000:60020
    3   180 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:65000
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:65001
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:65011
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8888 state NEW,ESTABLISHED
    0     0 ACCEPT     all  --  *      *       127.0.0.1            0.0.0.0/0           
  735 67148 ACCEPT     all  --  *      *       192.168.0.0/24       0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       46.238.126.0/23      0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       78.10.202.145        0.0.0.0/0           
    0     0 ACCEPT     all  --  *      *       109.173.223.100      0.0.0.0/0           
 1274  166K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1409  219K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp spt:8888 state ESTABLISHED

NAT:

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination    
  • You should not have to do that. Something else is going on. Can you edit your question to include a full dump of your iptables rules (iptables -L -n -v and iptables -t nat -L -n -v), particularly any rules about ESTABLISHED connections (which you no doubt need)? – Celada Jun 27 '15 at 10:26
  • Added requested logs. – rr- Jun 27 '15 at 11:16
  • Additionally, I'm configuring the firewall through SSH on port 22, but I'm not sure how this could affect connectivity on port 65000. – rr- Jun 27 '15 at 11:18
2

Turns out my router was set up to forward some high ports to the internal SSH port - so basically the problem was caused by some ancient configuration leftovers.

How stupid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.