How could i check which firewall rules are used by a particular service and whether port is blocked to restrict access by external users?
i.e
netstat -tulnp | grep 123
udp 0 0 0.0.0.0:123 0.0.0.0:* 1542/ntpd
I can't see LISTEN or ESTABLISHED in the output.
The firewall rules currently in effect are displayed by:
iptables -L -n -v
The ports in use for listening are displayed by
ss -lntp
ss -lnup
for TCP and UDP connections, respectively.
If you want, you can get a fairly good idea of what is happening even in another machine (and, for the sake of completeness, on your own too) by means of nmap:
nmap -p PORT_NUMBERS IP_ADDRESS
This will return the ports' status as open (a process is listening on it, and there is no firewall), closed (no one is listening on it), filtered (a firewall is protecting the port, and nmap is unable to tell whether the port is open or not), unfiltered when the ports respond to nmap which is however unable to tell whether the port is open or not.
The command you posted (obsolete, please use ss) is used to display listening ports, hence if the port you are interested in is not diplayed, it means the process which should be using such port is not running.
One way is using the tcpdump tool. You bind to a interface and say what you want to listen to and then you can debug what's happening.
So you want to see UDP packets on port 123. You would use something like this:
tcpdump -i any -n udp port 123
There, you'll see datagrams your machine receives on that port. It can even help you to debug some other issues if you don't see any UDP datagrams. If that is not enough, you can use the LOG action in the iptables command, so your rule would be also something like:
iptables -I INPUT -i eth0 -s 1.2.3.4 -p udp --dport 123 -j LOG
This way, any matching rule will be logged into your system log and you can trace if it's working like intended.
iptables -L -nmaybe?