What can silently block a port to be accessed on Ubuntu 10.04 Server?

Question

I've got a proprietary service running on port 8090 (actually running on a VBoxHeadless VM and capturing this port from the host machine) on an Internet server.

Nmap shows port 8090 open both on host and on VM. The service looks starting (and stopping if asked) ok. Telnet is able to connect to the port from a remote client side (but there's no data shown in telnet, so I can'be sure if it is working or not). Other services (such as Postfix and Dovecot) also working in a virtual machine (Debian Lenny though, while the host and the guest I am interested in run Ubuntu Lucid) work fine, Samba shares on the same VM work fine.

But a client (Windows, connected to host via OpenVPN (which is functioning - Samba works fine over it) over Internet) says it can't access that service there, on port 8090.

What can be blocking it? May it be some app-armour/selinux/hosts.allow thing or so? The service was installed 100% manually (following the manual), no scripts there).

UPDATE, to be more specific. I've just set up everything myself with mostly default configs and no special routing/firewalling. OpenVPN client and server configs are those from OpenVPN docs (and they were working once, when I was not using VMs), iptables rules (both on host and VM) are now set accept all and do nothing special, I only plan to secure them after I get the system working at all. hosts.allow/deny seem to be empty (everything is #-ed, as it goes out of the box).

As I've specified above, OpenVPN tunnell seems to work fine, as pings go there with no problems and accessing Samba over 445th port works fine (while it does not work via Internet if no OpenVPN used). There are no special access/routing rules set up there in OpenVPN config, neither are in iptables. Routing scheme is simple - a client requests server host (which can be accessed either via OpenVPN it runs, or directly via the Internet), then VirtualBox's natpf rules capture specific ports and take them to VMs (there are 2 VMs and no conflicts there, one runs a mail server, another runs Samba+FireBird+AbraAppServer(the last is the actual problematic service)).

I have zero knowledge about app-armour/selinux or whatever it is there in Ubuntu Lucid - may it be that? Keep in mind that if it's there, it's set up by default, like it is out of the box in Ubuntu 10.04 Server.

Answer 1

iptables -L and check your chains there, there could be a weird block rule for certain packets on port 8090. hosts.allow is another one to check.

One thing to check with VPN is your router config. Is the VPN subnet being recognised? Is there any kind of explicit allow/deny rules on the router at all? If so, what do they allow/deny, and is the VPN subnet included in any of them? Do you have port forwarding/passthrough set up on the router for port 8090?

What you might want to do, since you're VPNing straight to the computer and not to the router, is if you can set up a rule to forward traffic from port X to port 8090 IF (and only if) the data comes from your VPN subnet/address, and try accessing port X from over the VPN. If that works then you know you've got an issue on the local computer with allowing traffic to port 8090, if it doesn't then you can take a closer look at your router's config as it would seem that OpenVPN's NAT/firewall traversal may not be working on your network.