Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

The following are my iptable rules on a ubuntu cloud server:

cat /etc/iptables.rules:

*filter   
:INPUT DROP [598:41912]  
:FORWARD ACCEPT [0:0]  
:OUTPUT ACCEPT [456:35354] 
-A INPUT -i lo -j ACCEPT  
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT  
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT  
-A INPUT -m state -i eth0 --state ESTABLISHED,RELATED -j ACCEPT  
-A INPUT -s mycompany.dyndns.com -p tcp -m tcp --dport 22 -j ACCEPT  
-A INPUT -s mycompany.dyndns.com -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s mycompany.dyndns.com -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -j DROP
COMMIT

I did not open the ftp port 21 in the above iptable rules but I'm allowed to connect to the server via ftp. How?


nmap server-ip

Not shown: 987 closed ports 

PORT         STATE    SERVICE
21/tcp        open     ftp
22/tcp        open     ssh
25/tcp        open     smtp
53/tcp        open     domain
80/tcp        open     http
111/tcp       open     rpcbind
135/tcp       filtered msrpc
139/tcp       filtered netbios-ssn
389/tcp       open     ldap
445/tcp       filtered microsoft-ds
10000/tcp      open     java-or-OTGfileshare
2401/tcp      open     cvspserver
3306/tcp      open     mysql

Nmap done: 1 IP address (1 host up) scanned in 17.46 seconds

why these many ports are shown as open. I'm clear that these services are running on the server but how it could list or connect(ftp) these ports when it is not included in the iptable rules?.

need help...


The following script will be running at every 5 mins on cloud servers to update their iptables for the dyndns domain name:

#!/bin/bash
#
# A script to update iptable records for dynamic dns hosts.
# Written by: Dave Horner (http://dave.thehorners.com)
# Released into public domain.
#
# Run this script in your cron table to update ips.
#
# You might want to put all your dynamic hosts in a sep. chain.
# That way you can easily see what dynamic hosts are trusted.
#
# create the chain in iptables.
 /sbin/iptables -N dynamichosts
# insert the chain into the input chain @ the head of the list.
 /sbin/iptables -I INPUT 1 -j dynamichosts
# flush all the rules in the chain
 /sbin/iptables -F dynamichosts

HOST=$1
HOSTFILE="/root/host-$HOST"
CHAIN="dynamichosts"  # change this to whatever chain you want.
IPTABLES="/sbin/iptables"

# check to make sure we have enough args passed.
if [ "${#@}" -ne "1" ]; then
    echo "$0 hostname"
    echo "You must supply a hostname to update in iptables."
    exit
fi

# lookup host name from dns tables
IP=`/usr/bin/dig +short $HOST | /usr/bin/tail -n 1`
if [ "${#IP}" = "0" ]; then
    echo "Couldn't lookup hostname for $HOST, failed."
    exit
fi

OLDIP=""
if [ -a $HOSTFILE ]; then
    OLDIP=`cat $HOSTFILE`
    # echo "CAT returned: $?"
fi

# save off new ip.
echo $IP>$HOSTFILE

echo "Updating $HOST in iptables."
if [ "${#OLDIP}" != "0" ]; then
    echo "Removing old rule ($OLDIP)"
    `$IPTABLES -D $CHAIN -s $OLDIP/32 -j ACCEPT`
fi
echo "Inserting new rule ($IP)"
`$IPTABLES -A $CHAIN -s $IP/32 -j ACCEPT`

This is the output of "ipables -L" on the cloud server.

dynamichosts  all  --  anywhere             anywhere            
dynamichosts  all  --  anywhere             anywhere            
dynamichosts  all  --  anywhere             anywhere            
dynamichosts  all  --  anywhere             anywhere            
dynamichosts  all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere tcp dpt:www
ACCEPT     all  --  anywhere             anywhere state RELATED,ESTABLISHED 
ACCEPT     all  --  anywhere             anywhere state RELATED,ESTABLISHED 
ACCEPT     tcp  --  APKGS-AP-dynamic-145.136.165.59.airtelbroadband.in  anywhere tcp dpt:ssh 
ACCEPT     tcp  --  APKGS-AP-dynamic-145.136.165.59.airtelbroadband.in anywhere tcp dpt:10000 
ACCEPT     tcp  --  APKGS-AP-dynamic-145.136.165.59.airtelbroadband.in  anywhere tcp dpt:mysql 
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain dynamichosts (937 references)
target     prot opt source               destination         
ACCEPT     all  --  Telemedia-AP-dynamic-145.86.175.59.airtelbroadband.in  anywhere

Here the airtelbroadband is mine(dyndns domainname). I think the previously posted script creates new chain and from this domain everything is allowed -is it so?. May be the allowed ports ssh, webmin, mysql and www are useless entries. But I want this domain should be allowed only to these ports and I may have nmap listing only allowed ports on the cloud server when I check from my dyndns domain systems. Any more help...?

share|improve this question
    
could you please post the output of iptables -v -L instead of iptables -L ? You are using interface-based rules, and those are not listed correctly without -v ? –  Riccardo Murri Oct 12 '10 at 6:30

2 Answers 2

up vote 1 down vote accepted

This is the same question as http://serverfault.com/questions/188550/iptables-nmap-on-ubuntu

As people there suggest, your firewall rules have special exceptions for the cloud server itself (-A INPUT -i lo -j ACCEPT) or your "airtelbroadband" machine (the script you're running allows all traffic from the selected dyndns IP).

So, you need to run nmap from a different IP address (e.g., just use another machine in the cloud)

If you want to restrict access from your "airtelbroadband" host (e.g., for testing purposes), then you can replace the last line in your script with a list of the rules you want to apply. For example, the following lines will only allow SSH, HTTP/HTTPS and MySQL connections from your home host:

$IPTABLES -A $CHAIN -s $IP/32 -p tcp --dport 22 -j ACCEPT
$IPTABLES -A $CHAIN -s $IP/32 -p tcp --dport 80 -j ACCEPT
$IPTABLES -A $CHAIN -s $IP/32 -p tcp --dport 443 -j ACCEPT
$IPTABLES -A $CHAIN -s $IP/32 -p tcp --dport 3306 -j ACCEPT

Warning: It is very, very, very easy to lock yourself out of a running host by messing with the firewall rules, especially with automated scripts. Consider testing from a 3rd host instead.

share|improve this answer
    
yes your are right. The script allowing everything to my dyndns domain name. No way to allow only selected ports?. –  user3215 Oct 12 '10 at 1:10
    
@user3215 Yes, it's possible. I've updated the answer with some sketch instructions. –  Riccardo Murri Oct 12 '10 at 6:25
    
I hope it really works what you have suggested but still afraid of doing this and checking if there is any alternate way to do the same without any risk. For iptables I use 'iptables-apply -t 1800 /etc/iptables.rules' to avoid misconfiguration. –  user3215 Oct 12 '10 at 7:13
    
@user3215 Yes, but you cannot use iptables-restore for the dynamichosts table, since the IP in that table is changing - this is the reason for using a cron script in the first place. –  Riccardo Murri Oct 12 '10 at 7:50
    
How about if I use the drop option like the "$IPTABLES -A $CHAIN -s $IP/32 -p tcp --dport 21 -j DROP" just appending these kind of rules at the end of the script –  user3215 Oct 12 '10 at 8:51

Based on the output of your iptables -L, it seems there is nothing reading your /etc/iptables.rules file. Note the ACCEPT all -- anywhere anywhere match will let anything in.

You'll probably want to add something to /etc/rc.local to call iptables-restore < /etc/iptables.rules. Be careful you don't lock yourself out of your system, though. :)

share|improve this answer
    
The script is creating a new chain called 'dynamichosts'. Isn't it possible to append some rules so that it allows only ports specified to this chain. –  user3215 Oct 12 '10 at 1:06
    
the ACCEPT all -- anywhere anywhere is due to the rule -A INPUT -i lo -j ACCEPT: it will accept anything but only from the lo interface. Unfortunately, interface-level restrictions do not show up in regular iptables output. –  Riccardo Murri Oct 12 '10 at 6:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.