3

I am trying to telnet to a host on port 50000, which I verified that is listening to a DB2 instance (db2inst1).

 telnet [host] 50000

 telnet [ip_adress] 50000

But it gave the error: Connection timed out

I checked in the /etc/sysconfig/iptables file, and the firewall rules for port 50000 are properly set (they were saved and the iptables service was restarted):

-A INPUT -p tcp -m tcp --dport 50000 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 50000 -j ACCEPT

But still, I cannot telnet to this port. I disabled the service iptables and it allowed me to connect so that means there is something wrong with the firewall rules.

2

The question your firewall rules not working, is that when a machine is connecting to your DB server, from the point of the DB server, it is indeed the destination port; however when a packet is leaving the DB server, from the point of view of the DB server, the DB service/listening port is the source port.

As such, correcting direct your rules, it should be:

-A INPUT -p tcp -m tcp --dport 50000 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 50000 -j ACCEPT

Beware also of the localhost connections which are often needed by several daemons; you might need at the top of your rules:

-A INPUT -i lo -j ACCEPT
-A OUTPUT -i lo -j ACCEPT

Depending on your security requirements, and your number of rules, I would have a look at the the ESTABLISHED and RELATED directives. It would allow you to simplify your rules with stateful firewall aware rules.

ESTABLISHED meaning that the packet is associated with a connection which has seen packets in both directions, NEW meaning that the packet has started a new connection, or otherwise associated with a connection which has not seen packets in both directions, and RELATED meaning that the packet is starting a new connection, but is associated with an existing connection, such as an FTP data transfer, or an ICMP error.

  • Albeit out of topic, I would also advise reading Stevens "TCP/Illustrated, volume 1: The protocols" 2nd edition – Rui F Ribeiro Jun 21 '17 at 8:20
  • The OUTPUT doesn't work with the flag -i, neither with lo. Why is that – user3105533 Jun 22 '17 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.