Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

ipables configuration

Trying to allowing connection to a server from the outside world. Port scanners are reporting the ports are not open. Just after confirmation my iptables are correctly set.

eth0 - Private Lan
tun0 - VPN interface
ppp0 - Mobile broadband connection (no firewall restrictions from ISP)

-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -i ppp0 -p icmp -j ACCEPT
-A INPUT -i ppp0 -p udp -m multiport --dports 53,1194 -j ACCEPT
-A INPUT -i ppp0 -p tcp -m multiport --dports 25,53,80,143,443,587 -j ACCEPT

Hoping iptables is the culprit otherwise I'm going to have spend a lot more time on working on this server. Appreciate the assistance.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

If that is the entirety of your firewall ruleset, then I agree that you should have opened up traffic to UDP ports 53 and 1194, and TCP ports 25, 52, 80, 143, 443, and 587.

If you want a little more insight into whether it is your firewall that is the problem, add a last line

-A INPUT -j LOG --log-prefix "INPUT DROP: "

and watch to see if any log entries appear in the usual place (often /var/log/messages, but it will depend on your rsyslog setup).

If packets still don't make it through, but nothing is logged, you will have more confidence that something off-server is an issue. By the way, port scanners aren't the best way to tell if you've opened up a TCP port; try eg telnet server 443 from a random client. It's simpler and thus has less ways to fail than a port scanner, and so there is less risk of your drawing false conclusions.

share|improve this answer
    
Thank you for the info. Expedited clarifying if it is a iptables problem. As no drops are being recorded I am going to go back to the ISP and get them to test. The fight for workability continues. –  MasterJohn Dec 30 '13 at 10:03

Try adding this line,

-A INPUT -i ppp0 -p tcp  -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this answer
    
Please try posting a bit more detailed answers –  coincoin Dec 30 '13 at 10:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.