Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can you see what I'm doing wrong? On Ubuntu Server 9.1, I'm attempting to allow traffic on port 1143 for a non-privileged IMAP host.

Connection is refused when testing with

telnet example.com 1143

but connection is allowed testing with

telnet example.com 80

from my pc to remote internet hosted server. Both rules appear identical and are located near each other with no rules rejecting connections intervening in the rules file. I can't figure it out.

iptables -L returns this:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             127.0.0.0/8         reject-with icmp-port-unreachable 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http-alt 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:7070 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:1143 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level  debug prefix `iptables denied: ' 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

and my rules file contains this:

# Generated by iptables-save v1.4.4 on Wed May 26 19:08:34 2010
*nat
:PREROUTING ACCEPT [3556:217296]
:POSTROUTING ACCEPT [6909:414847]
:OUTPUT ACCEPT [6909:414847]
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 
COMMIT
# Completed on Wed May 26 19:08:34 2010
# Generated by iptables-save v1.4.4 on Wed May 26 19:08:34 2010
*filter
:INPUT ACCEPT [1:52]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1:212]
-A INPUT -i lo -j ACCEPT 
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 7070 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 1143 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 
-A INPUT -j REJECT --reject-with icmp-port-unreachable 
-A FORWARD -j REJECT --reject-with icmp-port-unreachable 
-A OUTPUT -j ACCEPT 
COMMIT
# Completed on Wed May 26 19:08:34 2010
share|improve this question
1  
What does netstat -ntlp | grep ':1143' give? –  Ignacio Vazquez-Abrams May 26 '10 at 20:01
    
Nothing. What would I have expected? –  marfarma May 26 '10 at 21:30
add comment

1 Answer 1

up vote 3 down vote accepted

Telnet to test a firewall only works if something is listening on that port. The netstat command Ignacio posted does this: netstat -ntlp | grep ':1143'

So you need to start the service, or, you can use something like netcat to make a listening port: nc -l 1143 as a temporary test.

share|improve this answer
    
Thanks. That's what I needed. I was actually debugging why my imap client wasn't connecting. Nothing to connect to explains it perfectly. Of course, why the imap server process is not binding the expected port is another kettle of fish entirely. –  marfarma May 27 '10 at 0:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.