Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a iptable rule file, on the INPUT chain I have

-A INPUT -i em1 -p tcp -m tcp --dport 54000 -j ACCEPT
-A INPUT -i em1 -p tcp -m tcp --dport 30000 -j ACCEPT
-A INPUT -i em1 -p udp -m udp --dport 54000 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct 
-A INPUT -j INPUT_ZONES
-A INPUT -p icmp -j ACCEPT

then I iptables-restore < rule_file and I started a UDP server on port 30000 which is not the allowed UDP port 54000 but the UDP server still get incoming UDP packets on 30000 what's wrong with this?

BTW, iptables -L -n , I get:

    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination 
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:54000
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:30000
    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:54000
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ES
    TABLISHED
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    INPUT_direct  all  --  0.0.0.0/0            0.0.0.0/0           
    INPUT_ZONES  all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     icmp --  0.0.0.0/0 

I use nmap from another machine to probe this machine

nmap -port 30000

or

nmap -port 54000

the results show that these two ports are closed!

share|improve this question
    
No rule actually drop or reject anything. Add one or check the policy ? –  BatchyX Apr 12 '13 at 18:14

3 Answers 3

up vote 1 down vote accepted
Chain INPUT (policy ACCEPT)

Your rules never match as you're accepting everything

Check the packets which matches with:

iptables -nvL

EDIT etagenklo: iptables go through all rules in a chain from top to bottom. If no rule is matching your packet, iptables will do what is defined as policy for the chain (in your case, this is ACCEPT)

To change your policy: iptables -P CHAIN RULE

iptables -P INPUT DROP
share|improve this answer
    
I don't get it. If the line Chain INPUT (policy ACCEPT) decide everything, what are the following rules used for? –  misteryes Apr 12 '13 at 19:39
    
In this exemple: nothing. Defining policy to accept and adding rules which jump to accept doesn't do anything. This makes sense if your are redirecting to another chain (a custom one for exemple) –  maxxvw Apr 12 '13 at 20:03
    
@misteryes: maxxvw is right. What iptables does is the following: it will go through all rules in a chain from top to bottom. If no rule is matching your packet, iptables will do what is defined as policy for the chain (in your case, this is ACCEPT). –  etagenklo Apr 12 '13 at 20:18
    
so how to modify the iptables rules? –  misteryes Apr 12 '13 at 20:18
    
-> see my answer. –  etagenklo Apr 12 '13 at 20:22

Remember, when you probe ports with nmap/telnet and getting the "closed" or "connection refused" or similar errors, it means you maybe doesn't have allowed the port OR you have the port allowed but no service listening on it.

I would personally write the rules this way:

-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT //if you want allow "familiar" packets
-A INPUT -p icmp -j ACCEPT
-A INPUT -i em1 -p tcp -m tcp --dport 54000 -j ACCEPT //the interface is optional if your pc has only one network card
-A INPUT -i em1 -p tcp -m tcp --dport 30000 -j ACCEPT
-A INPUT -i em1 -p udp -m udp --dport 54000 -j ACCEPT
-A INPUT -j INPUT_direct 
-A INPUT -j INPUT_ZONES
share|improve this answer
    
I have updated the question –  misteryes Apr 12 '13 at 17:43
    
answer update :) –  Fiisch Apr 12 '13 at 17:50
    
why do you change the order? I tried your version, still the UDP server still get incoming UDP packets on 30000 –  misteryes Apr 12 '13 at 18:01
    
BTW, what is INPUT_direct and INPUT_ZONES? –  misteryes Apr 12 '13 at 18:01
    
INPUT_ZONES can be accessed if INPUT_direct contains a -j RETURN. –  BatchyX Apr 12 '13 at 18:14

Change your policy for the chain to DROP:

iptables -P INPUT DROP

Of course you will have to make sure that there's an ACCEPT rule for everything you need.

Explanation:

iptables will check all the rules inside a chain if they match for your packet. If no rule is matching, the policy for the chain gets executed.

So this should be the standard configuration for a firewall: You want it to accept everything which is specified in a rule and drop everything else.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.