Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So after some battling and struggling with the firewall, i see that I may be doing something or the firewall isnt responding correctly there is has a port filter that is blocking certain ports.

Okay, here is what I did:

I made some changes to my iptables file, giving me endless issues and so I restored the iptables.old file

contents of iptables.old:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

after iptables.old restore(back to stock), nmap scan shows:

nmap [server ip]

Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 13:54 SAST
Nmap scan report for server.address.net ([server ip])
Host is up (0.014s latency).
Not shown: 997 filtered ports
PORT STATE SERVICE
22/tcp open ssh
113/tcp closed ident
8008/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 4.95 seconds

if I append rule: (to accept all tcp ports incoming to server on interface eth0)

iptables -A INPUT -i eth0 -m tcp -j ACCEPT

nmap output:

nmap [server ip]

Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 13:58 SAST
Nmap scan report for server.address.net ([server ip])
Host is up (0.017s latency).
Not shown: 858 filtered ports, 139 closed ports
PORT STATE SERVICE
22/tcp open ssh
443/tcp open https
8008/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 3.77 seconds

*notice it allows and opens port 443 but no other ports, and it removes port 113...?

removing previous rule and if I append rule: (allow and open port 80 incoming to server on interface eth0)

iptables -A INPUT -i eth0 -m tcp -p tcp --dport 80 -j ACCEPT

nmap output:

nmap [server ip]

Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 14:01 SAST
Nmap scan report for server.address.net ([server ip])
Host is up (0.014s latency).
Not shown: 996 filtered ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp closed http
113/tcp closed ident
8008/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 5.12 seconds

*notice it removes port 443 and allows 80 but is closed

without removing previous rule and if I append rule: (allow and open port 1723 incoming to server on interface eth0)

iptables -A INPUT -i eth0 -m tcp -p tcp --dport 1723 -j ACCEPT

nmap output:

nmap [server ip]

Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 14:05 SAST
Nmap scan report for server.address.net ([server ip])
Host is up (0.015s latency).
Not shown: 996 filtered ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp closed http
113/tcp closed ident
8008/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 5.16 seconds

*notice no change in ports opened or closed???

after removing rules:

iptables -A INPUT -i eth0 -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -m tcp -p tcp --dport 1723 -j ACCEPT

nmap output:

nmap [server ip]

Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 14:07 SAST
Nmap scan report for server.address.net ([server ip])
Host is up (0.015s latency).
Not shown: 998 filtered ports
PORT STATE SERVICE
22/tcp open ssh
113/tcp closed ident

Nmap done: 1 IP address (1 host up) scanned in 5.15 seconds

and returning rule: (to accept all tcp ports incoming to server on interface eth0)

iptables -A INPUT -i eth0 -m tcp -j ACCEPT

nmap output:

nmap [server ip]

Starting Nmap 6.00 ( nmap.org ) at 2013-11-01 14:07 SAST
Nmap scan report for server.address.net ([server ip])
Host is up (0.017s latency).
Not shown: 858 filtered ports, 139 closed ports
PORT STATE SERVICE
22/tcp open ssh
443/tcp open https
8008/tcp open http

Nmap done: 1 IP address (1 host up) scanned in 3.87 seconds

notice the eth0 changes the 999 filtered ports to 858 filtered ports, 139 closed ports

QUESTION:

why cant I allow and/or open a specific port, eg. I want to allow and open port 443, it doesnt allow it, or even 1723 for pptp, why am I not able to???

sorry for the layout, the editor was give issues (aswell... sigh)

share|improve this question
    
Do you specify what ports you want scanned? The default command does not scan all ports. You need to specify nmap -p0-65535 for example to scan all the ports. Could you do that and post the result back in your question via an edit. I believe you can also use nmap -p- (but am not sure). –  Rik Nov 1 '13 at 13:18
    
It's best practice to only open ports you want to use. In your details, I never saw an explicit rule for 443, so, if you want to open port 443, then make an explicit rule for it (instead of trying to allow all ports). If you want to open all ports, you might as well disable iptables altogether. –  CIA Nov 1 '13 at 13:35
    
Rik, I did as you said by scanning for a specific port, since I did not append the rule for opeing port 1723, i appended it with rule (-A INPUT -p tcp --dport 1723 -j ACCEPT) and nmap -p 1723 [serveer ip] resulted in 1723/tcp filtered pptp, and then I tried connecting again but i still couldnt –  user2699451 Nov 1 '13 at 13:59
    
@CIA, I do not want to open 443, i want to open 1723, but it struck me that appending the rule to open all ports, only 443 showed up and kicked 113 out of nmap scan –  user2699451 Nov 1 '13 at 14:00
    
Port 113 is not always shown as closed. In all cases it's best to specify the ports. So always do a nmap -p 1-1024,1723,8008 to see the important ports. (or adjust it accordingly) What i find strange is that in your 3rd nmap example port 8008 is open and when you remove port 80 it's gone. That makes me believe your not showing everything or you're mixing up your own results. But please show the nmap -p 1-1024,1723,8008 because we can't be sure what nmap does and does not scan otherwise. –  Rik Nov 1 '13 at 15:26

1 Answer 1

even 1723 for pptp

PPTP uses more then just port tcp/1723. It also uses the protocol GRE. Opening a single TCP port for PPTP or all ports will not permit PPTP to work. You also need to allow GRE.

The best results would be to use a stateful rule and load the pptp connection tracking modules into the kernel.

iptables -A INPUT ...

Your firewall contains a rule that looks like this -A INPUT -j REJECT. That is, you have a rule explicitly dropping traffic on the INPUT chain of the FILTER table. If you use iptables -A INPUT then you are appending a rule to the INPUT chain. Rules are processed in order, and the first match wins. Since you have a reject statement and you are appending the new rules after it, your reject will be evaluated before the appended rule has a chance to permit traffic.

share|improve this answer
    
To add to this answer. You can see here how you can configure iptables for PPTP on CentOS. This if you don't want to do it via system-config-firewall. –  Rik Nov 1 '13 at 22:08
    
@Zoredache, I tried that which you suggested, I appended rule for gre and port 47 (just to be sure) and removed the 2 reject rules, tried it again but exactly the same result –  user2699451 Nov 2 '13 at 17:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.