1

since i couldn't find anything that explains me what I am doing wrong I hope you guys can help.

I got a Ubuntu 18.04 server running. I want to open Port 9987 (just an example) so i Tried to add it to the INPUT and OUTPUT Chains with:

  • iptables -A INPUT -p tcp -m tcp --dport 9987 -j ACCEPT
  • iptables -A OUTPUT -p tcp -m tcp --dport 9987 -j ACCEPT

iptables -S output is:

root@v43524:~# iptables -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j REJECT --reject-with tcp-reset
-A INPUT -m state --state INVALID -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 12443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 11443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 11444 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8447 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8880 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 106 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5432 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9008 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9080 -j ACCEPT
-A INPUT -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8/0 -j ACCEPT
-A INPUT -j DROP
-A INPUT -p tcp -m tcp --dport 9987 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j REJECT --reject-with tcp-reset
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i lo -o lo -j ACCEPT
-A FORWARD -j DROP
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j REJECT --reject-with tcp-reset
-A OUTPUT -m state --state INVALID -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9987 -j ACCEPT

I believe some ot the forward rules is blocking this but I'm just new to Linux and tried to find the answer by googl'ing and testing.. reinstallting the server and again and again. Now i decided to hit stackexchange and ask for help.

(I even tried to remove all rules. After this try i couldn't connect via SSH:D)

Kind Regards

2

-A INPUT -j DROP

is before

-A INPUT -p tcp -m tcp --dport 9987 -j ACCEPT

and is blocking the last rule. you should move the 9987 rule above DROP.

  • 1
    Awesome! Now I get it. Didn't notice before IPTABLES is working like batch :D logical answer! Thanks a lot! – mace Jun 27 at 11:02
  • 1
    @mace iptables work from top to bottom, so you have to remember that if you put a blocking rule, anything below that corresponds to the rule will be blocked. – Bart Jun 27 at 11:10
  • 1
    @justinnoor.io, it is common to deny, but iptables digest rules from top to bottom and if you deny everything and then add a rule to allow something, it will not be processed as traffic would be denied later on. see also faqs.org/docs/iptables/traversingoftables.html – Bart Jun 27 at 13:14
  • 1
    @Bart perhaps “not correct” was too subjective, but I still think something else is going. That’s a messy ruleset to start with for someone who is new to iptables. – tilikoom Jun 27 at 14:22
  • 1
    @justinnoor.io, I agree on that, there's loads of rules there, but seems, judging by the requestor response, this was the case here that was blocking just one rule they entered below drop all rule – Bart Jun 27 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.