Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I think I've asked iptables to drop any packet for the port 8091, but the tcp connection still succeeds.

$ iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
$ iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
$ iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
$ iptables -A INPUT -i eth0 -j DROP
$ iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination     

$ telnet localhost 8091
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
(That means the TCP connection is established, despite the iptables rule)

Does that mean iptables is inactive? Do I have to 'apply' the rules or is iptables deactivated by default on Debian?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

You're setting the iptables rule on interface eth0, but telnetting to localhost, which is interface lo and therefore ignored by your iptables rules.

Try telnetting to the ip address of eth0 and see if you get the same result

share|improve this answer
    
Even if you didn't set the eth0 predicate there are certain chains loopbacks skip. I forget if input is one of them though. –  Falcon Momot Sep 29 '13 at 19:55
    
Hi jerm, I've tried with the IP address too (the one of eth0=142.4.202..., not 127.0.0.1 obviously) and it was the same result. –  Adrien Sep 29 '13 at 20:05
2  
Try telneting from another host and make sure you're making the connection via eth0 not some other interface. –  Matt Sep 29 '13 at 22:31
1  
Telneting to the address on eth0 from the local host is still via the lo interface as far as the kernel is concerned. You need to test from a remote host as @Matt has said. –  fukawi2 Sep 30 '13 at 1:42
    
You were right: I was using the lo interface. The glitch was, I couldn't test from another physical machine because of firewall restrictions (I'm using a VPS), and now that I can, the ports are open/closed as expected. Thanks! –  Adrien Sep 30 '13 at 8:46

It looks like your config should work. I duplicated it myself, and found that while I could still access the port from the server itself, access from outside was blocked.

Try to telnet from another location.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.