1

I've got Hetzner VPS with Ubuntu Server 16 (Server). I'd like to use it as HTTP-proxy from remote network and my problem is I can't access to proxy port outside Server. I use tinyproxy as simple http-proxy server but I think it doesn't matter because I tried Squid also.

Before asking I checked some basic moments:

  1. The firewall is disabled
root@g / # ufw status
Status: inactive
  1. Tinyproxy is running
root@g / # service tinyproxy status
● tinyproxy.service - LSB: Tinyproxy HTTP proxy
   Loaded: loaded (/etc/init.d/tinyproxy; bad; vendor preset: enabled)
   Active: active (running) since Thu 2019-03-28 19:58:11 CET; 1 day 2h ago
     Docs: man:systemd-sysv-generator(8)
  Process: 7494 ExecStop=/etc/init.d/tinyproxy stop (code=exited, status=0/SUCCESS)
  Process: 7499 ExecStart=/etc/init.d/tinyproxy start (code=exited, status=0/SUCCESS)
    Tasks: 11
   Memory: 5.4M
      CPU: 1.178s
   CGroup: /system.slice/tinyproxy.service
           ├─7537 /usr/sbin/tinyproxy
           ├─7540 /usr/sbin/tinyproxy
           ├─7541 /usr/sbin/tinyproxy
           ├─7542 /usr/sbin/tinyproxy
           ├─7543 /usr/sbin/tinyproxy
           ├─7544 /usr/sbin/tinyproxy
           ├─7545 /usr/sbin/tinyproxy
           ├─7546 /usr/sbin/tinyproxy
           ├─7547 /usr/sbin/tinyproxy
           ├─7548 /usr/sbin/tinyproxy
           └─7549 /usr/sbin/tinyproxy

Mar 28 19:58:11 german systemd[1]: Starting LSB: Tinyproxy HTTP proxy...
Mar 28 19:58:11 german tinyproxy[7499]: Starting tinyproxy: tinyproxy.
Mar 28 19:58:11 german systemd[1]: Started LSB: Tinyproxy HTTP proxy.
  1. Server is listening proxy port (8888)
root@g / # netstat -an | grep "LISTEN "
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:8888            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:1080            0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN
tcp6       0      0 :::80                   :::*                    LISTEN
tcp6       0      0 :::22                   :::*                    LISTEN
tcp6       0      0 :::5432                 :::*                    LISTEN
tcp6       0      0 ::1:25                  :::*                    LISTEN
tcp6       0      0 :::3002                 :::*                    LISTEN
tcp6       0      0 :::443                  :::*                    LISTEN
tcp6       0      0 :::3006                 :::*                    LISTEN
tcp6       0      0 :::2375                 :::*                    LISTEN
  1. Checked IP tables but I don't understand them TBH
root@g / # iptables -L -n -x -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
99952286 37369939710 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
 1634344 98674279 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    2343   144306 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
     788   286051 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:500
     442   164289 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:4500
  324726 21021269 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1080
 3462547 186835506 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
149920429 115433171227 DOCKER-ISOLATION  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   22887 309690442 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
       0        0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
   21746  1697123 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0
557186689 2014390071915 ACCEPT     all  --  *      br-770d85b66525  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
 6249909 363261028 DOCKER     all  --  *      br-770d85b66525  0.0.0.0/0            0.0.0.0/0
53787256 21286309449 ACCEPT     all  --  br-770d85b66525 !br-770d85b66525  0.0.0.0/0            0.0.0.0/0
 3331362 199881704 ACCEPT     all  --  br-770d85b66525 br-770d85b66525  0.0.0.0/0            0.0.0.0/0
41344046 8301225682 ACCEPT     all  --  *      *       10.10.10.0/24        0.0.0.0/0            policy match dir in pol ipsec proto 50
41041690 87245507143 ACCEPT     all  --  *      *       0.0.0.0/0            10.10.10.0/24        policy match dir out pol ipsec proto 50
   26679  3540888 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 74627 packets, 23792962 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain DOCKER (2 references)
    pkts      bytes target     prot opt in     out     source               destination
     150     6096 ACCEPT     tcp  --  !br-770d85b66525 br-770d85b66525  0.0.0.0/0            172.18.0.5           tcp dpt:3000
  132632  7919657 ACCEPT     tcp  --  !br-770d85b66525 br-770d85b66525  0.0.0.0/0            172.18.0.7           tcp dpt:5432
     291    13864 ACCEPT     tcp  --  !br-770d85b66525 br-770d85b66525  0.0.0.0/0            172.18.0.3           tcp dpt:3000
   20245  1130900 ACCEPT     tcp  --  !br-770d85b66525 br-770d85b66525  0.0.0.0/0            172.18.0.4           tcp dpt:443
  629141 35989923 ACCEPT     tcp  --  !br-770d85b66525 br-770d85b66525  0.0.0.0/0            172.18.0.4           tcp dpt:80

Chain DOCKER-ISOLATION (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  br-770d85b66525 docker0  0.0.0.0/0            0.0.0.0/0
       0        0 DROP       all  --  docker0 br-770d85b66525  0.0.0.0/0            0.0.0.0/0
149920429 115433171227 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
  1. Checked that I can access proxy from localhost. Don't worry about 403 error it caused by permissions but I've got response at least:
root@g / # curl -x 127.0.0.1:8888 -v  http://google.com
* Rebuilt URL to: http://google.com/
*   Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 8888 (#0)
> GET http://google.com/ HTTP/1.1
> Host: google.com
> User-Agent: curl/7.47.0
> Accept: */*
> Proxy-Connection: Keep-Alive
>
* HTTP 1.0, assume close after body
< HTTP/1.0 403 Access denied
< Server: tinyproxy/1.8.3
< Content-Type: text/html
< Connection: close
...
  1. My attempt to access from outside using external server IP. I tried it from remote network and even from Server's console.
root@g / # curl -x IP_ADDRESS:8888 -v  http://google.com
* Rebuilt URL to: http://google.com/
*   Trying IP_ADDRESS...
* connect to IP_ADDRESS port 8888 failed: Connection timed out
* Failed to connect to IP_ADDRESS port 8888: Connection timed out
* Closing connection 0
curl: (7) Failed to connect to IP_ADDRESS port 8888: Connection timed out

So I'm stuck here and have no ideas what to check else. The Server used also as SOCKS5-proxy and http/https server without any problems with outside access. Could you give me any advice what else can I check?

  • When you use iptables -L it does port lookups and doesn't list interfaces and such, which is annoying. Please replace with the out put of iptables -L -n -x -v. That being said, it looks as though there is no INPUT path for port 8888 from the outside, but not sure yet. – Doug Smythies Mar 29 at 23:37
  • @DougSmythies updated iptables results with another flags. And you was absolutely right. I opened port manually with iptables -I INPUT -p tcp -m tcp --dport 8888 -j ACCEPT and now I can reach proxy from external network. But I confused a bit at this point: I thought that OS should handle it automatically or all ports was opened by default. – Ilya Krigouzov Mar 30 at 10:31
  • Where did your existing iptables rule set come from? It is typically true that ports are not blocked by default, but that doesn't look like any default iptables rule set. – Doug Smythies Mar 30 at 14:41
  • It's a good question. As you noticed I'm not good in iptables so it's look like I just copy-pasted some instructions from Internet some years ago for more secure setup of my Ubuntu Server and it was fine until I need to change something today. So it's totally my fault and I'm really appreciate your help. – Ilya Krigouzov Mar 30 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.