0

Consider the following rules running on my router on 192.168.1.1 (yes, they're unconventional):

iptables -t filter -I       INPUT 1 -p tcp --source 192.168.0.0/16 --destination-port "$PORT" --jump ACCEPT
iptables -t nat    -I       INPUT 1 -p tcp --source 192.168.0.0/16 --destination-port "$PORT" --jump SNAT --to-source      192.168.2.1
iptables -t nat    -I  PREROUTING 1 -p tcp --source 192.168.0.0/16 --destination-port "$PORT" --jump DNAT --to-destination 192.168.1.1

When $PORT is not 445 (say, when it's 444), these rules work fine.
When $PORT is 445 (SMB), though, these rules do not work.

Note that I do not have Samba (or anything else caring about port 445) running on the router, though you should be able to infer this from the fact that socat has no listening conflict below.
(And no, I do not have any other iptables rules regarding port 445.)

For example, I observe the following on my router

$ socat -d -d tcp-listen:444 -     # this is on the router
socat[29117] N listening on AF=2 0.0.0.0:444
socat[29117] N accepting connection from AF=2 192.168.2.1:42339 on AF=2 192.168.1.1:444
socat[29117] N reading from and writing to stdio
socat[29117] N starting data transfer loop with FDs [6,6] and [0,1]
socat[29117] N socket 1 (fd 6) is at EOF
socat[29117] N exiting with status 0

when I run the following on a local machine:

netcat -w 1 -t -n -z "$(dig +short myip.opendns.com @resolver1.opendns.com)" 444 <<<"" && echo Success || echo Failed

However, if I do exactly the same things above with port 445 rather than 444, socat stays forever listening on AF=2 0.0.0.0:445 and netcat prints Failed after a short pause.

Therefore, I suspect something in the router's kernel is filtering out public traffic to port 445, probably for security reasons (yes, I'm well aware of the security issues).
However, that is obviously just a guess, and I have no idea how to check/disable what is going on.

How might this be happening and how can I verify this?


Here's some more info that might help. Let's say I enable logging

iptables -v -t nat -I       INPUT -d "$MACHINE_IP" -j LOG
iptables -v -t nat -I      OUTPUT -d "$MACHINE_IP" -j LOG
iptables -v -t nat -I  PREROUTING -d "$MACHINE_IP" -j LOG
iptables -v -t nat -I POSTROUTING -d "$MACHINE_IP" -j LOG
iptables -v -t nat -I       INPUT -s "$MACHINE_IP" -j LOG
iptables -v -t nat -I      OUTPUT -s "$MACHINE_IP" -j LOG
iptables -v -t nat -I  PREROUTING -s "$MACHINE_IP" -j LOG
iptables -v -t nat -I POSTROUTING -s "$MACHINE_IP" -j LOG

where $MACHINE_IP is just the IP of my local machine. Now if I run

netcat -w 1 -t -n -z "$PUBLIC_IP" 444 <<<"Test" && echo Success || echo Failed

I get back the following (where I've formatted & redacted as appropriate):

kernel:        IN=br0 OUT= MAC="$MAC" SRC="$MACHINE_IP" DST="$PUBLIC_IP" LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=51334 DF PROTO=TCP SPT=42366 DPT=444                     WINDOW=29200 RES=0x00 SYN URGP=0
kernel: ACCEPT IN=br0 OUT= MAC="$MAC" SRC="$MACHINE_IP" DST=192.168.1.1  LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=51334 DF PROTO=TCP SPT=42366 DPT=444 SEQ=496897934 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 OPT (<redacted>)
kernel:        IN=br0 OUT= MAC="$MAC" SRC="$MACHINE_IP" DST=192.168.1.1  LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=51334 DF PROTO=TCP SPT=42366 DPT=444                     WINDOW=29200 RES=0x00 SYN URGP=0
kernel: ACCEPT IN=br0 OUT= MAC="$MAC" SRC="$MACHINE_IP" DST=192.168.1.1  LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=51335 DF PROTO=TCP SPT=42366 DPT=444 SEQ=496897934 ACK=0 WINDOW=29200 RES=0x00 SYN URGP=0 OPT (<redacted>)

But, if I run

netcat -w 1 -t -n -z "$PUBLIC_IP" 445 <<<"Test" && echo Success || echo Failed

then I only get back:

kernel:        IN=br0 OUT= MAC="$MAC" SRC="$MACHINE_IP" DST="$PUBLIC_IP" LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=40192 DF PROTO=TCP SPT=39617 DPT=445                     WINDOW=29200 RES=0x00 SYN URGP=0
kernel:        IN=br0 OUT= MAC="$MAC" SRC="$MACHINE_IP" DST="$PUBLIC_IP" LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=40193 DF PROTO=TCP SPT=39617 DPT=445                     WINDOW=29200 RES=0x00 SYN URGP=0

It's weird that $PUBLIC_IP doesn't get translated at all in the second one. Why would that happen? etc.

8
  • I would start by telling us what the router is. We can't tell you how to verify it if we don't know what you're looking at. If it's a home router, you're probably on the wrong site.
    – user143703
    Oct 25 '17 at 1:12
  • pcaps and complete iptables rulesets would probably be helpful. Also the netfilter processing traces (iptables [...] -j TRACE).
    – womble
    Oct 25 '17 at 5:49
  • @womble: To be honest I'm hesitant to post detailed router information... I'd rather not make the precise network setup public, as you might imagine. Can I ask what you think might cause a different behavior for different port numbers when none of them is listed in the rulesets? i.e. what would you be looking for besides the actual port numbers being of significance (which I can already see don't exist)?
    – user541686
    Oct 25 '17 at 6:07
  • 1
    To put it bluntly, we don't trust that you're not missing something obvious. You say they're not in there, but plenty of questions posted here turn out to be down to the OP not noticing something that a fresh set of eyes notices immediately. "When you see hoofprints, think horses, not zebras" -- it's far more likely that it's something simple and obvious, rather than strange in-kernel settings that nobody else has ever heard of. You don't have to post anything you don't want to, but the chances are you won't get an answer otherwise.
    – womble
    Oct 25 '17 at 6:15
  • @womble: Yeah, I've missed tons of obvious things before myself... I wouldn't trust me either. Sadly despite that I'm not sure I'd like to post the information requested here, as much as I would normally want to. :\ If it becomes enough of a pain to be worth it I might change my mind later though. Thanks for the comments in either case!
    – user541686
    Oct 25 '17 at 6:25
0

I finally figured it out myself. It was a kernel module. echo 0 > /proc/net/lfpctrl fixes the issue.

2
  • That appears to be associated with a proprietary kernel module that appears to be for Asus routers, whose sole purpose is to futz with port 445 traffic. It's good that you figured this out on your own, but mentioning you were running an Asus might have triggered a memory in someone and they could have pointed you in the right direction quicker...
    – womble
    Oct 26 '17 at 1:06
  • @womble: Yeah, oh well. Hope this at least helps someone else.
    – user541686
    Oct 26 '17 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.