1

Running an up-to-date installation of Kubuntu 21.10.

If I run any network service on the machine, I'm unable to reach it from anywhere else on my network. The error is always "Host unreachable". A tcpdump scan reveals the SYN packet does reach the host, but an ICMP "admin-prohibited" packet is immediately sent back. The packet never even reaches iptables (verified by adding a rule that would match a connection, and it's counter never increases)

nmap is also unable to detect the port as open, however its scan does show up in the counter. nmap interprets the port as filtered because the prohibited packet is ICMP; no response to the SYN packet is sent.

Here is the tcpdump output, on the host machine with a service actively listening on port 8000, that appears when another machine tries to connect:

04:43:09.154362 IP 192.168.1.3.56608 > 192.168.1.183.8000: Flags [S], seq 3664350430, win 64240, options [mss 1460,sackOK,TS val 2819866111 ecr 0,nop,wscale 7], length 0
04:43:09.154417 IP 192.168.1.183 > 192.168.1.3: ICMP host 192.168.1.183 unreachable - admin prohibited filter, length 68

Here is what happens when nmap scans:

04:44:49.060156 ARP, Request who-has 192.168.1.183 tell 192.168.1.3, length 46
04:44:49.060177 ARP, Reply 192.168.1.183 is-at 74:e6:e2:da:19:0f, length 28
04:44:49.156156 IP 192.168.1.3.33094 > 192.168.1.183.8000: Flags [S], seq 4114316293, win 1024, options [mss 1460], length 0
04:44:49.156260 IP 192.168.1.183 > 192.168.1.3: ICMP host 192.168.1.183 unreachable - admin prohibited filter, length 52

iptables is completely clear, ACCEPT policy on all default chains, no rules whatsoever on filter, nat and mangle.

Services can be accessed locally using localhost or the machine's IP on the machine itself. The only issue is trying to access from the network.

I do have Docker on the machine, but for trying to figure this out, I disabled Docker and removed all of its iptables rules and chains. If services are started as Docker containers, they are able to be reached from the network. But I am trying to run a service outside of a container.

The machine also has VirtualBox installed, if that's relevant, but at the time of testing no VirtualBox machines were running.

Also of important note is that the SSH server running on the host can be reached successfully - this is the only service that is reachable, regardless of what else is running:

Starting Nmap 7.91 ( https://nmap.org ) at 2022-01-26 11:00 UTC
Nmap scan report for 192.168.1.183
Host is up (0.00035s latency).
Not shown: 65534 filtered ports
PORT      STATE SERVICE
22/tcp    open  ssh
MAC Address: *redacted*
Too many fingerprints match this host to give specific OS details

Nmap done: 1 IP address (1 host up) scanned in 78.45 seconds

Is there perhaps a kernel setting somewhere that is causing this to occur?

Edit: As requested here is iptables-save output, but it's totally empty...

# Generated by iptables-save v1.8.7 on Wed Jan 26 06:17:24 2022
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Wed Jan 26 06:17:24 2022
# Generated by iptables-save v1.8.7 on Wed Jan 26 06:17:24 2022
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Wed Jan 26 06:17:24 2022
4
  • Edit your question and post sudo iptables-save output please. Jan 26, 2022 at 12:03
  • @ArtemS.Tashkinov It's literally completely blank, no rules whatsoever, I even cleared the Docker chains just in case. But I posted it anyway.
    – fdmillion
    Jan 26, 2022 at 12:18
  • That looks weird, I've no idea what could be going on. Any network devices between these servers/PCs? Jan 26, 2022 at 12:21
  • Just for sure. Can you post sudo ifconfig and ip a output please?
    – K-attila-
    Jan 26, 2022 at 13:19

1 Answer 1

1

Turns out Kubuntu has the same "issue" as recent CentOS releases in that it uses nftables, so iptables can be completely clear but there's still another firewall playing with the IP stack.

The quick solution, if you want to disable this extra firewall and just use iptables, is to execute:

sudo systemctl disable --now firewalld

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .