My home internet connection has a static IP address (eg:
I have configured my router to forward port
9000 to an internal host (
192.168.1.101), which is running
netcat listening on port 9000:
$ nc -l 9000
Connecting from inside my LAN:
On another machine on my LAN I can telnet to that port:
$ telnet 192.168.1.101 9000 Trying 192.168.1.101... Connected to 192.168.1.101. Escape character is '^]'. hello world
and the connection succeeds
$ nc -l 9000 hello world
Connecting from outside my LAN:
However, if I try to connect via my external IP address I cannot get through:
$ telnet 18.104.22.168 9000 Trying 22.214.171.124...
I tried to allow port 9000 on iptables (I am no expert on
$ sudo iptables -I INPUT 1 -p tcp --dport 9000 -j ACCEPT
This is my resulting configuration:
$ sudo iptables -L -n -v Chain INPUT (policy ACCEPT 203 packets, 16977 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9000 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 178 packets, 23749 bytes) pkts bytes target prot opt in out source destination
telnet still can't get through.
I think the
iptables config might be unnecessary anyway though, because
ufw status says it's inactive:
$ sudo ufw status Status: inactive
Port scanning says it's open:
If I run a port scanner on my external IP with
nc -l 9000 running it says the port is open.
If I run
tcpdump I can't see anything coming in on port 9000 when I try
telnet to the port. However, running the port scanner does show up:
18:41:34.023692 IP 126.96.36.199.49977 > my_host.9000: Flags [S], seq 3955039481, win 14600, options [mss 1400,sackOK,TS val 4051434607 ecr 0,nop,wscale 8], length 0 18:41:34.023748 IP my_host.9000 > 188.8.131.52.49977: Flags [S.], seq 3541700333, ack 3955039482, win 28960, options [mss 1460,sackOK,TS val 465840988 ecr 4051434607,nop,wscale 7], length 0 18:41:34.250110 IP 184.108.40.206.49977 > my_host.9000: Flags [.], ack 1, win 58, options [nop,nop,TS val 4051434663 ecr 465840988], length 0 18:41:34.250973 IP 220.127.116.11.49977 > my_host.9000: Flags [F.], seq 1, ack 1, win 58, options [nop,nop,TS val 4051434664 ecr 465840988], length 0 18:41:34.251035 IP my_host.9000 > 18.104.22.168.49977: Flags [F.], seq 1, ack 2, win 227, options [nop,nop,TS val 465841045 ecr 4051434664], length 0 18:41:34.477197 IP 22.214.171.124.49977 > my_host.9000: Flags [.], ack 2, win 58, options [nop,nop,TS val 4051434720 ecr 465841045], length 0
I'm at a bit of a loss as to where the problem is.
- How can I diagnose where the issue is?
- How come the port scan data comes through, but not my telnet?
- How can I allow incoming connections?