1

I'm afraid it's going to be a rather open-ended question, but I feel I deserve to ask it here, having spent a couple weeks on this to no avail. I'll add to the things I've tried and hopefully we'll narrow it down.

I'm running Arch Linux on my desktop and would like to run a web server on it to serve the local network. I've tried some common network services, and nothing really works, except...

SSH works. I've added the rule to accept incoming connections to 22 port, started sshd service and it reliably works. I have, for debugging, closed the 22 port and this disables connecting from remote hosts, so the firewall apparently working. Here's my current firewall configuration:

sudo iptables -nL
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3838
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4999
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:2121
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate     RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
DROP       all  --  0.0.0.0/0            0.0.0.0/0            ctstate  INVALID
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8 ctstate NEW
UDP        udp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEW
TCP        tcp  --  0.0.0.0/0            0.0.0.0/0            tcp flags:0x17/0x02 ctstate NEW
REJECT     udp  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0            reject-with tcp-reset
REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-proto-unreachable

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain TCP (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:3838
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4999
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80

Chain UDP (1 references)
target     prot opt source               destination         

And here's my network device configuration:

ip addr 

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
   valid_lft forever preferred_lft forever
inet6 ::1/128 scope host 
   valid_lft forever preferred_lft forever
2: enp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
link/ether e0:d5:5e:23:ee:3f brd ff:ff:ff:ff:ff:ff
3: enp0s31f6: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
link/ether e0:d5:5e:23:ee:3d brd ff:ff:ff:ff:ff:ff
4: wlp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 9c:b6:d0:1d:f7:97 brd ff:ff:ff:ff:ff:ff
inet 192.168.30.123/24 brd 192.168.30.255 scope global dynamic noprefixroute wlp2s0
   valid_lft 406681sec preferred_lft 406681sec
inet6 fe80::5dfe:2375:7e24:d383/64 scope link noprefixroute 
   valid_lft forever preferred_lft forever

So then I start nginx (I've tried different web servers, comment if you want me to try something in particular) with this config (excerpt):

/etc/nginx/nginx.conf

server {
    listen       80;
    server_name  0.0.0.0;
    server_name  192.168.30.123;
    #charset koi8-r;

    #access_log  logs/host.access.log  main;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

ss -tulnp shows this:

NetidState  Recv-Q Send-Q                       Local Address:Port  Peer     Address:Port                                
udp  UNCONN 0      0                    192.168.30.123%wlp2s0:68         0.0.0.0:*                                   
udp  UNCONN 0      0                           192.168.30.123:123        0.0.0.0:*                                   
udp  UNCONN 0      0                                127.0.0.1:123        0.0.0.0:*                                   
udp  UNCONN 0      0                                  0.0.0.0:123        0.0.0.0:*                                   
udp  UNCONN 0      0       [fe80::5dfe:2375:7e24:d383]%wlp2s0:123           [::]:*                                   
udp  UNCONN 0      0                                    [::1]:123           [::]:*                                   
udp  UNCONN 0      0                                     [::]:123           [::]:*                                   
tcp  LISTEN 0      128                                0.0.0.0:80         0.0.0.0:*                                   
tcp  LISTEN 0      128                                0.0.0.0:22         0.0.0.0:*                                   
tcp  LISTEN 0      5                                127.0.0.1:631        0.0.0.0:*                                   
tcp  LISTEN 0      128                              127.0.0.1:4999       0.0.0.0:*     users:(("R",pid=13147,fd=10)) 
tcp  LISTEN 0      128                                   [::]:22            [::]:*                                   
tcp  LISTEN 0      5                                    [::1]:631           [::]:*                                   
tcp  LISTEN 0      128                                      *:3838             *:*                                   

So to me this looks like the ports are open and something listens to them. The sample page is served to localhost, but not from LAN. I've set up a similar server on my laptop on the same wireless LAN, and it serves to the whole LAN (including the problem machine) , so I think that means the network itself is fine. I've tested with tcpdump as well (that's tcpdump running on the problematic machine):

sudo tcpdump port 80

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on wlp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
16:22:56.156589 IP 192.168.30.132.51764 > s-l.http: Flags [S], seq 1909655952, win 29200, options [mss 1460,sackOK,TS val 4135754645 ecr 0,nop,wscale 7], length 0
16:22:58.717288 IP 192.168.30.132.51766 > s-l.http: Flags [S], seq 16903 94439, win 29200, options [mss 1460,sackOK,TS val 4135757197 ecr 0,nop,wscale 7], length 0
16:23:00.183474 IP 192.168.30.132.51768 > s-l.http: Flags [S], seq 872524670, win 29200, options [mss 1460,sackOK,TS val 4135758723 ecr 0,nop,wscale 7], length 0
16:23:00.970190 IP 192.168.30.132.51770 > s-l.http: Flags [S], seq 3470413477, win 29200, options [mss 1460,sackOK,TS val 4135759430 ecr 0,nop,wscale 7], length 0

That's four hits of refresh from my laptop. This really frustrates me, because the packages seem to be arriving, but nothing's responding to them.

EDIT: I have tried runApp(".", host="0.0.0.0" , port=4999) for shiny, but it still only serves localhost. And it still wouldn't explain nginx. (This is for a different web server).

0

Although I have no experience with shiny, have you tried binding to the actual address of the network interface? Obtain in with ifconfig -a.

You've already tried something like that with:

 runApp(".", host="0.0.0.0" , port=4999)

But try something like:

runApp(".", host="<if_ip>” , port=3838)

Also, port 4999 wouldn't work, since you didn't open that up in the mentioned iptables config.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.