1

since i couldn't find anything that explains me what I am doing wrong I hope you guys can help.

I got a Ubuntu 18.04 server running. I want to open Port 9987 (just an example) so i Tried to add it to the INPUT and OUTPUT Chains with:

  • iptables -A INPUT -p tcp -m tcp --dport 9987 -j ACCEPT
  • iptables -A OUTPUT -p tcp -m tcp --dport 9987 -j ACCEPT

iptables -S output is:

root@v43524:~# iptables -S
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j REJECT --reject-with tcp-reset
-A INPUT -m state --state INVALID -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 12443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 11443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 11444 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8447 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8880 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 106 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5432 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9008 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 9080 -j ACCEPT
-A INPUT -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8/0 -j ACCEPT
-A INPUT -j DROP
-A INPUT -p tcp -m tcp --dport 9987 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j REJECT --reject-with tcp-reset
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i lo -o lo -j ACCEPT
-A FORWARD -j DROP
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j REJECT --reject-with tcp-reset
-A OUTPUT -m state --state INVALID -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 9987 -j ACCEPT

I believe some ot the forward rules is blocking this but I'm just new to Linux and tried to find the answer by googl'ing and testing.. reinstallting the server and again and again. Now i decided to hit stackexchange and ask for help.

(I even tried to remove all rules. After this try i couldn't connect via SSH:D)

Kind Regards

Improve this question

1 Answer 1

Reset to default
2

-A INPUT -j DROP

is before

-A INPUT -p tcp -m tcp --dport 9987 -j ACCEPT

and is blocking the last rule. you should move the 9987 rule above DROP.

Improve this answer
6
  • 1
    Awesome! Now I get it. Didn't notice before IPTABLES is working like batch :D logical answer! Thanks a lot!
    – mace
    Commented Jun 27, 2019 at 11:02
  • 1
    @mace iptables work from top to bottom, so you have to remember that if you put a blocking rule, anything below that corresponds to the rule will be blocked.
    – Bart
    Commented Jun 27, 2019 at 11:10
  • 1
    @justinnoor.io, it is common to deny, but iptables digest rules from top to bottom and if you deny everything and then add a rule to allow something, it will not be processed as traffic would be denied later on. see also faqs.org/docs/iptables/traversingoftables.html
    – Bart
    Commented Jun 27, 2019 at 13:14
  • 1
    @Bart perhaps “not correct” was too subjective, but I still think something else is going. That’s a messy ruleset to start with for someone who is new to iptables.
    – user223600
    Commented Jun 27, 2019 at 14:22
  • 1
    @justinnoor.io, I agree on that, there's loads of rules there, but seems, judging by the requestor response, this was the case here that was blocking just one rule they entered below drop all rule
    – Bart
    Commented Jun 27, 2019 at 14:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .