0

I'm trying to open port 30080 on an Ubuntu 18.04 Server vm and seeing some confusing results.

iptables output

ubuntu@k8-master:~$ sudo iptables -v -x -n -L
[sudo] password for ubuntu:
Chain INPUT (policy ACCEPT 289 packets, 98798 bytes)
    pkts      bytes target     prot opt in     out     source               destination
    3919   272820 KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes service portals */
    3919   272820 KUBE-EXTERNAL-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes externally-visible service portals */
  846424 164692436 KUBE-FIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 KUBE-FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes forwarding rules */
       0        0 KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes service portals */
       0        0 DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
       0        0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0
       0        0 ACCEPT     all  --  *      *       10.244.0.0/16        0.0.0.0/0
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            10.244.0.0/16

Chain OUTPUT (policy ACCEPT 281 packets, 145464 bytes)
    pkts      bytes target     prot opt in     out     source               destination
    6870   412563 KUBE-SERVICES  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes service portals */
  846213 192244364 KUBE-FIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER (1 references)
    pkts      bytes target     prot opt in     out     source               destination

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-USER (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain KUBE-EXTERNAL-SERVICES (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            /* robot-shop/web:8080 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:30080 reject-with icmp-port-unreachable

Chain KUBE-FIREWALL (2 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

Chain KUBE-FORWARD (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes forwarding rules */ mark match 0x4000/0x4000
       0        0 ACCEPT     all  --  *      *       10.0.0.0/16          0.0.0.0/0            /* kubernetes forwarding conntrack pod source rule */ ctstate RELATED,ESTABLISHED
       0        0 ACCEPT     all  --  *      *       0.0.0.0/0            10.0.0.0/16          /* kubernetes forwarding conntrack pod destination rule */ ctstate RELATED,ESTABLISHED

Chain KUBE-SERVICES (3 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 REJECT     tcp  --  *      *       0.0.0.0/0            10.96.93.102         /* robot-shop/cart:8080 has no endpoints */ tcp dpt:8080 reject-with icmp-port-unreachable
       0        0 REJECT     tcp  --  *      *       0.0.0.0/0            10.111.89.174        /* robot-shop/web:8080 has no endpoints */ tcp dpt:8080 reject-with icmp-port-unreachable

Also, ufw shows the port as open:

sudo ufw status
Status: active

To               Action      From
--               ------      ----
30080            ALLOW       Anywhere
30080/tcp        ALLOW       Anywhere

Netstat also shows the port in "Listening" mode:

netstat -talpn | grep 30080
tcp6    0    0 :::30080      :::*           LISTEN      -

So I'm not sure why nmap still shows the port as filtered:

nmap -Pn localhost -p 30080 
PORT      STATE    SERVICE
30080/tcp filtered unknown

And if I try from a remote machine, nmap shows as closed:

PORT      STATE  SERVICE
30080/tcp closed unknown

Not sure where to go from here.

Improve this question
4
  • We need the entire context to be able to comment, meaning we need the entire iptables rule set. Do sudo iptables -v -x -n -L and edit your question to include the output.You only seem to be listening to IPv6, but are you also using IPv4?
    – Doug Smythies
    Nov 18, 2019 at 19:26
  • Edited my question with the full iptables output. also, looks like your observation is correct. Not sure why ipv4 for port 30080 is non existent.
    – trimonkeytri
    Nov 18, 2019 at 20:11
  • This VM, is it itself behind NAT or a firewall? Is this an EC2 instance or an OpenStack instance running this system? If so those roll default firewalls so you'll have to open the ports in that hosting system/service first.
    – Thomas Ward ♦
    Nov 18, 2019 at 20:13
  • i have a shuttle box at home running esxi 6. This is a vm on that. I've been doing some research and I think this has more to do with kubernetes environment rather than ubuntu firewalls.
    – trimonkeytri
    Nov 18, 2019 at 20:44

1 Answer 1

Reset to default
1

After doing some research, I think this is a kubernetes issue. Seems kube-proxy is adding this line:

/* robot-shop/web:8080 has no endpoints */ ADDRTYPE match dst-type LOCAL tcp dpt:30080 reject-with icmp-port-unreachable

So I think I'll close this topic and open another in the kubernetes section. Thanks.

Improve this answer
2
  • I think you should now be able to set it as solution.
    – davidbaumann
    Nov 19, 2019 at 16:15
  • how do i do that?
    – trimonkeytri
    Nov 20, 2019 at 1:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .