0

please advice:

I add next iptables rules:

iptables -I OUTPUT 2 -p udp --dport 53 -j ACCEPT
iptables -I OUTPUT 2 -p udp --dport 1700:1750 -j ACCEPT
iptables -I OUTPUT 3 -p udp -m udp --dport 1812 -j ACCEPT
iptables -I OUTPUT 5 -p udp -m udp --dport 1813 -j ACCEPT
iptables -I OUTPUT 5 -p udp -m udp --dport 5950:6050 -j ACCEPT
iptables -I OUTPUT 5 -p udp -m udp --dport 499:510 -j ACCEPT
iptables -I OUTPUT 5 -p udp -m udp --dport 4490:4550 -j ACCEPT
iptables -I OUTPUT 20 -p udp -j DROP

But, after apply: ipsec, l2tp and openvp udp port 6000 stops working

Advice, what is wrong?

Here is my udp services:

udp        0      0 0.0.0.0:500             0.0.0.0:*                           3115/charon     
udp        0      0 0.0.0.0:1701            0.0.0.0:*                           2885/xl2tpd     
udp        0      0 162.243.256.150:6000    0.0.0.0:*                           2818/openvpn    
udp        0      0 0.0.0.0:4500            0.0.0.0:*                           3115/charon     
udp6       0      0 :::500                  :::*                                3115/charon     
udp6       0      0 :::4500                 :::* 

                           3115/charon
  • 1
    Please, send us the result of 'iptables -L -n -v' – Dom Apr 28 '14 at 9:44
  • I'm confused. If the iptables rules and the services are running on the same box, why are you allowing the destination ports of your services in the OUTPUT chain, not the INPUT chain? If those are two different boxes, please explain your setup. – Dubu Apr 28 '14 at 12:47
  • Question was also asked on unix.stackexchange.com/questions/126874/… – Dubu Apr 28 '14 at 13:17
0

You're using the OUTPUT chain, not the INPUT one, so when you're putting dport, that's the destination port for OUTPUT, which means the remote port, not the one on the machine you're having the iptables running and services on.

You should change the chain to INPUT and in that case the dport would be what you want, meaning the port on your server.

edit : In addition to adding those rules you will probably have to create the appropriate corresponding rules in the OUTPUT chain aswel, with a -sport this time.

0

Save yourself a lot of trouble and have a look at shorewall. It makes this much simpler to configure and manage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.