0

I'm trying to open port 30080 on an Ubuntu 18.04 Server vm and seeing some confusing results.

iptables output

ubuntu@k8-master:~$ sudo iptables -v -x -n -L
[sudo] password for ubuntu:
Chain INPUT (policy ACCEPT 289 packets, 98798 bytes)
    pkts      bytes target     prot opt in     out     source               destination
    3919   272820 KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes service portals */
    3919   272820 KUBE-EXTERNAL-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes externally-visible service portals */
  846424 164692436 KUBE-FIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 KUBE-FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes forwarding rules */
       0        0 KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes service portals */
       0        0 DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
       0        0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     all  --  *      *       10.244.0.0/16        0.0.0.0/0
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            10.244.0.0/16

Chain OUTPUT (policy ACCEPT 281 packets, 145464 bytes)
    pkts      bytes target     prot opt in     out     source               destination
    6870   412563 KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes service portals */
  846213 192244364 KUBE-FIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-USER (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain KUBE-EXTERNAL-SERVICES (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* robot-shop/web:8080 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:30080 reject-with icmp-port-unreachable

Chain KUBE-FIREWALL (2 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

Chain KUBE-FORWARD (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes forwarding rules */ mark match 0x4000/0x4000
       0        0 ACCEPT     all  --  *      *       10.0.0.0/16          0.0.0.0/0            /* kubernetes forwarding conntrack pod source rule */ ctstate RELATED,ESTABLISHED
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            10.0.0.0/16          /* kubernetes forwarding conntrack pod destination rule */ ctstate RELATED,ESTABLISHED

Chain KUBE-SERVICES (3 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 REJECT     tcp  --  *      *       0.0.0.0/0            10.96.93.102         /* robot-shop/cart:8080 has no endpoints */ tcp dpt:8080 reject-with icmp-port-unreachable
       0        0 REJECT     tcp  --  *      *       0.0.0.0/0            10.111.89.174        /* robot-shop/web:8080 has no endpoints */ tcp dpt:8080 reject-with icmp-port-unreachable

Also, ufw shows the port as open:

sudo ufw status
Status: active

To               Action      From
--               ------      ----
30080            ALLOW       Anywhere
30080/tcp        ALLOW       Anywhere

Netstat also shows the port in "Listening" mode:

netstat -talpn | grep 30080
tcp6    0    0 :::30080      :::*           LISTEN      -

So I'm not sure why nmap still shows the port as filtered:

nmap -Pn localhost -p 30080 
PORT      STATE    SERVICE
30080/tcp filtered unknown

And if I try from a remote machine, nmap shows as closed:

PORT      STATE  SERVICE
30080/tcp closed unknown

Not sure where to go from here.

  • We need the entire context to be able to comment, meaning we need the entire iptables rule set. Do sudo iptables -v -x -n -L and edit your question to include the output.You only seem to be listening to IPv6, but are you also using IPv4? – Doug Smythies Nov 18 '19 at 19:26
  • Edited my question with the full iptables output. also, looks like your observation is correct. Not sure why ipv4 for port 30080 is non existent. – trimonkeytri Nov 18 '19 at 20:11
  • This VM, is it itself behind NAT or a firewall? Is this an EC2 instance or an OpenStack instance running this system? If so those roll default firewalls so you'll have to open the ports in that hosting system/service first. – Thomas Ward Nov 18 '19 at 20:13
  • i have a shuttle box at home running esxi 6. This is a vm on that. I've been doing some research and I think this has more to do with kubernetes environment rather than ubuntu firewalls. – trimonkeytri Nov 18 '19 at 20:44
1

After doing some research, I think this is a kubernetes issue. Seems kube-proxy is adding this line:

/* robot-shop/web:8080 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:30080 reject-with icmp-port-unreachable

So I think I'll close this topic and open another in the kubernetes section. Thanks.

| improve this answer | |
  • I think you should now be able to set it as solution. – davidbaumann Nov 19 '19 at 16:15
  • how do i do that? – trimonkeytri Nov 20 '19 at 1:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.