I have a weird issue.
I am running a mail server behind a proxy. On the proxy all mail related ports are forwarded to the mail server:
peter#proxy:~$ sudo iptables -S
[sudo] password for peter:
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -p tcp -m tcp --dport 3389 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -i ens192 -o ens160 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens160 -o ens192 -j ACCEPT
-A FORWARD -d 10.10.0.15/32 -p tcp -m tcp --dport 3389 -j ACCEPT
-A FORWARD -d 10.10.0.5/32 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -d 10.10.0.5/32 -p tcp -m tcp --dport 143 -j ACCEPT
-A FORWARD -d 10.10.0.5/32 -p tcp -m tcp --dport 587 -j ACCEPT
-A FORWARD -d 10.10.0.5/32 -p tcp -m tcp --dport 465 -j ACCEPT
-A FORWARD -d 10.10.0.5/32 -p tcp -m tcp --dport 993 -j ACCEPT
-A FORWARD -d 10.10.0.5/32 -p tcp -m tcp --dport 995 -j ACCEPT
-A FORWARD -d 10.10.0.5/32 -p tcp -m tcp --dport 25 -j ACCEPT
As you can see all the mailing related ports are forwarded to the mail server (10.10.0.5). I can telnet from outside into all the ports, except 25. From the proxy I can also telnet into the mail server on port 25. So the port is blocked on the proxy side.
Nothing else is listening on port 25:
peter#proxy:~$ sudo netstat -plutn
[sudo] password for peter:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1457/sshd
tcp6 0 0 :::443 :::* LISTEN 1512/apache2
tcp6 0 0 :::587 :::* LISTEN 1508/xinetd
tcp6 0 0 :::80 :::* LISTEN 1512/apache2
tcp6 0 0 :::465 :::* LISTEN 1508/xinetd
tcp6 0 0 :::22 :::* LISTEN 1457/sshd
This is what I get when I try telneting from the outside:
peter#ubuntu-desktop:~$ telnet mx0.xyz.com 25
Trying 5.199.xxx.yyy...
telnet: Unable to connect to remote host: Connection refused
peter#ubuntu-desktop:~$ telnet mx0.xyz.com 110
Trying 5.199.xxx.yyy...
Connected to mx0.xyz.com.
Escape character is '^]'.
+OK POP3 ready
quit
+OK
Connection closed by foreign host.
Same for the other ports.
I can send emails but I cannot receive any, the gmail server reports a Connection refused error.
[mx0.xyz.com. 5.199.xxx.yyy: FAILED_PRECONDITION: connect error (111): Connection refused]
How can I figure out what's blocking port 25 and how can I open it?
Related
I am trying to connect my android app to server, using TCP connection.
for that, i am using HAProxy server. below is the configuration for same.
frontend fe-plain-cs
bind xx.xx.xx.xx:8443 transparent
default_backend be-plain-cs
backend be-plain-cs
fullconn 50000
balance roundrobin
source 0.0.0.0 usesrc clientip
server k010 xx.xx.xx.xx:8443 check inter 10m fall 1 rise 1 maxconn 25000
server k011 xx.xx.xx.xx:8443 check inter 10m fall 1 rise 1 maxconn 25000
if you need more info let me know.
below is my iptable rules:
:PREROUTING ACCEPT [2:230]
:INPUT ACCEPT [2:230]
:OUTPUT ACCEPT [3:370]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -s 10.13.0.0/16 ! -d xx.xx.xx.xx/32 -j ACCEPT
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination :8080
-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination :8443
-A PREROUTING -p tcp -m tcp --dport 843 -j DNAT --to-destination :8843
-A POSTROUTING -s xx.xx.xx.xx/32 -j ACCEPT
-A POSTROUTING -s 10.13.0.0/16 -j MASQUERADE
COMMIT
below is my sys
/etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.ip_nonlocal_bind = 1
net.ipv4.conf.default.rp_filter = 1
Stop your iptables service and Selinux should be disabled.
service iptables stop
Vi etc/selinux/config
selinux=disabled
I am trying to host my Spring Boot application on Arvixe's VPS Lite. No CPanel, just command line.
When I spin up my Spring Boot app and navigate to the server's IP address, I see the ERR_CONNECTION_REFUSED error.
Here is my iptables configuration. I followed the steps found here http://crm.vpscheap.net/knowledgebase.php?action=displayarticle&id=29
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
-A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
-A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT
-A INPUT -j DROP
COMMIT
Here are the policies that the above creates
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:http state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:https state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:ssh state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:https state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:http state ESTABLISHED
ACCEPT udp -- anywhere anywhere udp spt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:http limit: avg 25/min burst 100
DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp spt:http state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:https state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp spt:ssh state ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:https state NEW,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:http state NEW,ESTABLISHED
ACCEPT udp -- anywhere anywhere udp dpt:domain
In your iptables config you are opening up ports 80 and 443 but spring-boot applications are starting on port 8080 per default. So you have two options:
Start the app listing on port 80 by adding --server.port=80 to the start up params or set server.port=80 in the application.properties. This will work but you'll have to start the app as root since it trying to bind to a well known port. I wouldn't recommend this.
Use iptables to redirect the external port 80 to be forwarded internally to port 8080 by adding a line like the following to your iptables config
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
i have to configure my server to redirect from 80 and 443 port due to 8443 using iptables
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80:443 -j REDIRECT --to-ports 8443
when i browse like https protocol everything is working, but when from http, i can just donwnload a file, and don't see anything
8443 port is intended mainly to use as HTTPS proxy. Sending plain HTTP to this port will not work. You should keep separated HTTP and HTTPS traffic by sending them to a different port (normally 8080) of your transparent proxy.
using this rule :
-A PREROUTING -i eth0 -p tcp -m tcp --dport 80:443 -j REDIRECT --to-ports 8443
you allowed only incoming traffic to to be sent to port 8443, but still the outgoing traffic needs to be routed
I've built a new box on our network to serve a new web application. It's a CentOS server running on a local IP address 172.25.97.25 and local hostname truleadsap01:80.
SELinux has been disabled.
This address is NAT'ed and routed up to a public domain www.foobar.co.za and public IP address x.x.x.x.
I've configured httpd correctly because when I navigate to local hostname, I see the app. However, when I use either the public domain or IP address, it doesn't load the page.
From my httpd.conf:
Listen 172.25.97.25:80
ServerName truleadsap01:80
From /etc/sysconfig/iptables:
# Completed on Tue Dec 10 18:17:02 2013
# Generated by iptables-save v1.4.7 on Tue Dec 10 18:17:02 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [31:2744]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth+ -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -s 196.15.219.218/32 -i eth0 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -i eth+ -j ACCEPT
-A FORWARD -o eth+ -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i lo -o etho0 -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT
COMMIT
# Completed on Tue Dec 10 18:17:02 2013
Despite following a lot of tutorials on-line and making numerous changes, I'm still not able to browse to the public domain.
UPDATE I: I checked the access log when I access the site from the public domain. I get this entry repeatedly:
172.25.121.5 - - [11/Dec/2013:10:22:22 +0200] "GET /" 302 - "-" "-"
Your help is much appreciated.
The httpd.conf you posted only shows what IP:port is should listen on and the expected ServerName:port. I'll try to answer based on some possibilities.
Check that port 80 is indeed accessible by running the following command from a remote node.
nc 172.25.97.25 80 < /dev/null
If the connection is successful you may want to check access_log and error_log to see if the server is only accepting request URL with the configured ServerName. If this is the case, you might have virtualHost configured.
Try adding the public IP address to the listen line in the httpd.conf file (I am assuming it is a static IP).
This is my iptables config:
sudo iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
859 103K ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
5 260 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
3 230 ACCEPT tcp -- any any anywhere anywhere tcp dpt:27017
4 208 ACCEPT tcp -- any any anywhere anywhere tcp dpt:28017
0 0 ACCEPT all -- any any localhost anywhere
0 0 ACCEPT all -- any any 111.111.111.111 anywhere
0 0 ACCEPT all -- any any 222.222.222.222 anywhere
64 3844 DROP all -- any any anywhere anywhere
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 764 packets, 227K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any any localhost anywhere
0 0 ACCEPT all -- any any 111.111.111.111 anywhere
0 0 ACCEPT all -- any any 222.222.222.222 anywhere
If I write in browser the ip if my mongodb server with port 28017, I can see a promt to enter username and password:
#ip mongodb server
000.000.000.000:28017
I want close mongodb ports to anyone except to these 2 ips:
111.111.111.111
222.222.222.222
How can I do it?
Can you try the following iptables rules
-A INPUT -m state --state NEW -p tcp --destination-port 27017 -s 111.111.111.111 -j ACCEPT
-A INPUT -m state --state NEW -p tcp --destination-port 27017 -s 222.222.222.222 -j ACCEPT
Looks like you forgot to put in the source IP flag.
I have removed of my iptables these two line:
-A INPUT -p tcp -m tcp --dport 27017 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 28017 -j ACCEPT
and now it's not possible access to mongdb ports from any ip.
Thanks
The rules I use for limiting external access to mongo are:
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- localhost anywhere tcp dpt:27017
ACCEPT tcp -- localhost anywhere tcp dpt:28017
ACCEPT tcp -- 111.111.111.111 anywhere tcp dpt:27017
ACCEPT tcp -- 222.222.222.222 anywhere tcp dpt:27017
ACCEPT tcp -- 111.111.111.111 anywhere tcp dpt:28017
ACCEPT tcp -- 222.222.222.222 anywhere tcp dpt:28017
DROP tcp -- anywhere anywhere tcp dpt:27017
DROP tcp -- anywhere anywhere tcp dpt:28017
You can add them with
sudo iptables -A INPUT -p tcp -m tcp --dport 27017 -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --dport 28017 -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --dport 27017 -s 111.111.111.111 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --dport 27017 -s 222.222.222.222 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --dport 28017 -s 111.111.111.111 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --dport 28017 -s 222.222.222.222 -j ACCEPT
sudo iptables -A INPUT -p tcp -m tcp --dport 27017 -j DROP
sudo iptables -A INPUT -p tcp -m tcp --dport 28017 -j DROP