2

I have a local network (doesn't really matter if it's VPN or real local network - I've tried both).

One computer running Linux Mint opens a socket with

mint$ nc -l 4242

And the second one running OpenSUSE can connect and send messages to the socket:

suse$ nc 10.8.0.10 4242

But if I try to open a socket on Suse and connect from Mint - the connection won't establish. I don't have ufw firewall installed on Suse at all.

I tried to send TCP packets from Mint to a Windows PC and it worked well, so I guess, that the problem is in Suse machine.

I have also tried picking higher port numbers (55555 for example) just in case but with no luck.

iptables -L -v on Suse:

Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination         
 272 23240 ACCEPT     all  --  lo     any     anywhere             anywhere            
  28  5183 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate ESTABLISHED
   0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             ctstate RELATED
  15  4984 input_ext  all  --  any    any     anywhere             anywhere            
   0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-IN-ILL-TARGET "
   0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target     prot opt in     out     source               destination         
   0     0 LOG        all  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-FWD-ILL-ROUTING "

Chain OUTPUT (policy ACCEPT 47 packets, 7142 bytes)
pkts bytes target     prot opt in     out     source               destination         
 272 23240 ACCEPT     all  --  any    lo      anywhere             anywhere            

Chain forward_ext (0 references)
pkts bytes target     prot opt in     out     source               destination         

Chain input_ext (1 references)
pkts bytes target     prot opt in     out     source               destination         
   2  1956 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = broadcast
   0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp source-quench
   0     0 ACCEPT     icmp --  any    any     anywhere             anywhere             icmp echo-request
  13  3028 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = multicast
   0     0 DROP       all  --  any    any     anywhere             anywhere             PKTTYPE = broadcast
   0     0 LOG        tcp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
   0     0 LOG        icmp --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
   0     0 LOG        udp  --  any    any     anywhere             anywhere             limit: avg 3/min burst 5 ctstate NEW LOG level warning tcp-options ip-options prefix "SFW2-INext-DROP-DEFLT "
   0     0 DROP       all  --  any    any     anywhere             anywhere            

Chain reject_func (0 references)
pkts bytes target     prot opt in     out     source               destination         
   0     0 REJECT     tcp  --  any    any     anywhere             anywhere             reject-with tcp-reset
   0     0 REJECT     udp  --  any    any     anywhere             anywhere             reject-with icmp-port-unreachable
   0     0 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-proto-unreachable

What can cause this issue?

  • Do iptables -L on Suse. – Tomasz Nov 17 '16 at 21:11
  • @tomas I've added it to my question. – Max Nov 18 '16 at 4:31
  • It looks like it will be better to replace the output of iptables -L with one of iptables -L -v. It will bring more details. Sorry for this. – Tomasz Nov 18 '16 at 4:40
  • @tomas updated with iptables -L -v – Max Nov 18 '16 at 6:39
  • 1
    run on suse sudo iptables -I INPUT -p tcp --dport 4242 -j ACCEPT – بارپابابا Nov 18 '16 at 7:07
2

use this command:

sudo iptables -I INPUT -p tcp --dport 4242 -j ACCEPT

the last line of your suse INPUT chain is:

   0     0 DROP       all  --  any    any     anywhere             anywhere            

that means DROP all INPUT packet, with this command

sudo iptables -I INPUT -p tcp --dport 4242 -j ACCEPT

we Insert new rule for accept input packet top and before run DROP rule

and this rule not work for new connection :

ACCEPT     all  --  any    any     anywhere             anywhere             ctstate ESTABLISHED

because that stats is ESTABLISHED to this mean:

RELATED - The connection is new, but is related to another connection already permitted. ESTABLISHED - The connection is already established.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.