1

I'm trying to configure iptables to allow connections from a remote connection to access mongodb on port 27017. below are my rules

  ACCEPT     tcp  --  any    any     anywhere  anywhere    tcp dpt:27017

*reject_all_else here*

This works fine for remote connections, but fails to connect on the loopback interface. Adding below with port doesn't work.

iptables -I INPUT 1 -i lo -p tcp --dport 27017 -j ACCEPT

But allowing all loopback without specifying ports does. Does loopback change ports or do something else weird ?

iptables -I INPUT 1 -i lo -p tcp -j ACCEPT

tcmdump below

[root@localhost ~]# tcpdump -i lo -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes
17:19:49.528039 IP 127.0.0.1.59372 > 127.0.0.1.27017: Flags [S], seq 2525021556, win 43690, options [mss 65495,sackOK,TS val 10984445 ecr 0,nop,wscale 7], length 0
20:57:14.735029 IP 127.0.0.1.27017 > 127.0.0.1.59372: Flags [S.], seq 1048378415, ack 2525021557, win 43690, options [mss 65495,sackOK,TS val 10984445 ecr 10984445,nop,wscale 7], length 0
17:19:49.528102 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable - admin prohibited, length 68
17:19:50.531012 IP 127.0.0.1.59372 > 127.0.0.1.27017: Flags [S], seq 2525021556, win 43690, options [mss 65495,sackOK,TS val 10985448 ecr 0,nop,wscale 7], length 0
22:09:02.588230 IP 127.0.0.1.27017 > 127.0.0.1.59372: Flags [S.], seq 1064049928, ack 2525021557, win 43690, options [mss 65495,sackOK,TS val 10985448 ecr 10985448,nop,wscale 7], length 0
17:19:50.531066 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable - admin prohibited, length 68
17:19:52.535030 IP 127.0.0.1.59372 > 127.0.0.1.27017: Flags [S], seq 2525021556, win 43690, options [mss 65495,sackOK,TS val 10987452 ecr 0,nop,wscale 7], length 0
00:32:29.704695 IP 127.0.0.1.27017 > 127.0.0.1.59372: Flags [S.], seq 1095362915, ack 2525021557, win 43690, options [mss 65495,sackOK,TS val 10987452 ecr 10987452,nop,wscale 7], length 0
17:19:52.535109 IP 127.0.0.1 > 127.0.0.1: ICMP host 127.0.0.1 unreachable - admin prohibited, length 68
  • Please add the output of tcpdump -i lo -n while accessing the service. – Hauke Laging Aug 8 '17 at 20:09
  • added the tcpdump. seems like some port 59372 is being used. Is that the source port ? – Abhinav Vishak Aug 8 '17 at 21:23
  • Yes, that is the source port. – Hauke Laging Aug 9 '17 at 6:58
2

In contrast to what it seems like the problem is not connecting to the service: The problem is the response.

I guess that your Netfilter configuration is missing this important standard rule:

iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED
  • my output connections are not filtered, so makes sense that a remote mongo would get the response, and why local mongo is failing since it goes through the INPUT filter and fails. your solution doesnt work , but puts me in the right direction. thanks. – Abhinav Vishak Aug 8 '17 at 21:45
  • @AbhinavVishak I assume the remote mongo works because there is a similar rule limited to the external interface. Without such a rule you could not even access web sites. – Hauke Laging Aug 8 '17 at 22:05
1

Based on Hauke's answer the following worked for me .

iptables -I INPUT 1 -m state --state RELATED,ESTABLISHED -j ACCEPT

mongo was able to reach mongod through the INPUT rule, but as Hauke pointed out, the response from mongod was getting filtered( as opposed to a remote connection since all outbound traffic is allowed).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.