IPtables not blocking certain ports

Question

I've my iptables configuration to allow some communications, but I've noticed that I do not have a specific rule to allow traffic using port TCP 993 (used by my email client). When I open my e-mail client all communications through port TCP/993 are passing through the firewall. Obviously I want this traffic, but it is strange that I've allowed this in my firewall.

Here's my iptables rules;

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [1:76]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:LOGGING - [0:0]
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -m comment --comment "Allow any related or establishe connections" -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -m comment --comment "Allow any related or establishe connections" -j ACCEPT
-A INPUT -i lo -m comment --comment "Allow incoming traffic to loopback" -j ACCEPT
-A OUTPUT -o lo -m comment --comment "Allow outgoing traffic to loopback" -j ACCEPT
-A INPUT -i eth1+ -p udp -m udp --dport 67:68 -m comment --comment "Allow incoming DHCP" -j ACCEPT
-A INPUT -i eth1.10 -p tcp -m tcp --dport 21 -s 10.10.10.0/24 -m comment --comment "Allow incoming FTP from VLAN10" -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 21 -m comment --comment "Allow outgoing FTP" -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -s 10.10.10.0/24 -m comment --comment "Allow incoming SSH from VLAN10" -j ACCEPT
-A OUTPUT -o eth1+ -p tcp -m tcp --dport 22 -m comment --comment "Allow outgoing SSH" -j ACCEPT
-A INPUT -i eth1+ -p udp -m udp --dport 53 -m comment --comment "Allow incoming UDP DNS" -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -m comment --comment "Allow outgoing UDP DNS" -j ACCEPT
-A INPUT -i eth1+ -p tcp -m tcp --dport 80 -m comment --comment "Allow incoming HTTP" -j ACCEPT
-A INPUT -i eth1+ -p tcp -m tcp --dport 443 -m comment --comment "Allow incoming HTTPS" -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 80 -m comment --comment "Allow outgoing HTTP" -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 443 -m comment --comment "Allow outgoing HTTPS" -j ACCEPT
-A FORWARD -i eth1+ -o eth0 -m comment --comment "Allow traffic from all internal (eth1+) to external (eth0)" -j ACCEPT
-A FORWARD -i eth0 -o eth1+ -m comment --comment "Allow traffic from all internal (eth1+) to external (eth0)" -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j LOGGING
-A INPUT -p tcp --tcp-flags ALL ALL -j LOGGING
-A INPUT -p tcp --tcp-flags ALL NONE -j LOGGING
-A INPUT -f -j LOGGING
-A INPUT -j LOGGING
-A OUTPUT -j LOGGING
-A LOGGING -m limit --limit 5/minute -j LOG --log-prefix "ipt-dropped: " --log-level 7
-A LOGGING -j DROP
COMMIT

*mangle
:PREROUTING ACCEPT [4:1084]
:INPUT ACCEPT [4:1084]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1:76]
:POSTROUTING ACCEPT [1:76]
COMMIT

So, you can see there's no rule (i think) allowing tcp/993.

With tcpdump:

13:20:13.683689 IP 64.90.62.162.993 > 10.10.10.12.62264: Flags [P.], seq 6234:6288, ack 735, win 236, length 54
13:20:13.687844 IP 10.10.10.12.62264 > 64.90.62.162.993: Flags [P.], seq 735:792, ack 6288, win 515, length 57
13:20:13.913290 IP 64.90.62.162.993 > 10.10.10.12.62264: Flags [P.], seq 6288:6651, ack 792, win 236, length 363
13:20:13.916872 IP 10.10.10.12.62264 > 64.90.62.162.993: Flags [P.], seq 792:832, ack 6651, win 514, length 40

Is there some think I'm mistaking in my rules?

Hope anybody help me.

Regards. Rafael.

Answer 1

When your e-mail client starts a session, it is permitted as an outgoing initiated session. You have a rule to allow in packets that are ESTABLISHED,RELATED, which replies to your e-mail client would be.

Your tcpdump catpure is incomplete, not showing the TCP session initiating SYN and SYN ACK packets between you and upstream.