Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I cant reach my server from outside in some ports like 4280 (proserver) or 10000 (webmin).

If i telnet from localhost i can reach.

I have installed iredmail.

I don't know how i can diagnose the problem, and if the problem are in my host company. But before i complain about that i want to know more details to figure if the problem is mine.

iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination         
fail2ban-postfix  tcp  --  anywhere             anywhere            multiport dports www,https,smtp,ssmtp,pop3,pop3s,imap2,imaps,sieve 
fail2ban-ssh  tcp  --  anywhere             anywhere            tcp dpt:ssh 
fail2ban-roundcube  tcp  --  anywhere             anywhere            multiport dports www,https,smtp,ssmtp,pop3,pop3s,imap2,imaps,sieve 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            multiport dports www,https,smtp,ssmtp,pop3,pop3s,imap2,imaps,submission,ssmtp,ssh 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-dovecot (0 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-postfix (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-roundcube (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-ssh (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere    

netstat -l

# netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 localhost.localdo:10024 *:*                     LISTEN     
tcp        0      0 localhost.localdom:9000 *:*                     LISTEN     
tcp        0      0 localhost.localdo:10025 *:*                     LISTEN     
tcp        0      0 localhost.localdo:mysql *:*                     LISTEN     
tcp        0      0 *:submission            *:*                     LISTEN     
tcp        0      0 *:pop3                  *:*                     LISTEN     
tcp        0      0 localhost.localdom:9998 *:*                     LISTEN     
tcp        0      0 *:imap2                 *:*                     LISTEN     
tcp        0      0 localhost.localdo:10031 *:*                     LISTEN     
tcp        0      0 *:webmin                *:*                     LISTEN     
tcp        0      0 *:ssmtp                 *:*                     LISTEN     
tcp        0      0 localhost.locald:domain *:*                     LISTEN     
tcp        0      0 *:ssh                   *:*                     LISTEN     
tcp        0      0 *:smtp                  *:*                     LISTEN     
tcp        0      0 localhost.localdoma:953 *:*                     LISTEN     
tcp        0      0 localhost.localdo:sieve *:*                     LISTEN     
tcp        0      0 *:imaps                 *:*                     LISTEN     
tcp        0      0 localhost.localdom:7777 *:*                     LISTEN     
tcp        0      0 *:pop3s                 *:*                     LISTEN     
tcp6       0      0 [::]:www                [::]:*                  LISTEN     
tcp6       0      0 ip6-localhost:domain    [::]:*                  LISTEN     
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN     
tcp6       0      0 [::]:4280               [::]:*                  LISTEN     
tcp6       0      0 ip6-localhost:953       [::]:*                  LISTEN     
tcp6       0      0 [::]:4282               [::]:*                  LISTEN     
tcp6       0      0 [::]:4283               [::]:*                  LISTEN     
tcp6       0      0 [::]:https              [::]:*                  LISTEN     
tcp6       0      0 [::]:4285               [::]:*                  LISTEN     
udp        0      0 localhost.locald:domain *:*                                
udp        0      0 *:10000                 *:*                                
udp        0      0 localhost.localdoma:921 *:*                                
udp6       0      0 ip6-localhost:domain    [::]:*  
share|improve this question
    
What does "netstat -l" say? –  Raffael Luthiger Nov 7 '11 at 0:43
    
i should post it before –  balsagoth Nov 7 '11 at 0:52
    
i found the solution, but i cant answer my own question now. More details here iredmail.org/forum/… –  balsagoth Nov 7 '11 at 1:03

1 Answer 1

up vote 3 down vote accepted

There are few things to note here

  • your iptables default policy is set to DROP packets. that means, every packet will be dropped, unless it is allowed explicitly by iptables. and in your INPUT chain, there is no rule to allow the ports you have mentioned. so you need to allow webmin and other ports through iptables manually.

  • Also, as you have FAIL2BAN installed, it blocks your IP after a number of failed attempts to server, and you cannot login for some time (usually an hour) so try to diable fail2ban first. add specific allowed ports in iptables INPUT chain and test the connectivity. then turn on fail2ban.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.