0



I've my iptables configuration to allow some communications, but I've noticed that I do not have a specific rule to allow traffic using port TCP 993 (used by my email client). When I open my e-mail client all communications through port TCP/993 are passing through the firewall. Obviously I want this traffic, but it is strange that I've allowed this in my firewall.

Here's my iptables rules;

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [1:76]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:LOGGING - [0:0]
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -m comment --comment "Allow any related or establishe connections" -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -m comment --comment "Allow any related or establishe connections" -j ACCEPT
-A INPUT -i lo -m comment --comment "Allow incoming traffic to loopback" -j ACCEPT
-A OUTPUT -o lo -m comment --comment "Allow outgoing traffic to loopback" -j ACCEPT
-A INPUT -i eth1+ -p udp -m udp --dport 67:68 -m comment --comment "Allow incoming DHCP" -j ACCEPT
-A INPUT -i eth1.10 -p tcp -m tcp --dport 21 -s 10.10.10.0/24 -m comment --comment "Allow incoming FTP from VLAN10" -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 21 -m comment --comment "Allow outgoing FTP" -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -s 10.10.10.0/24 -m comment --comment "Allow incoming SSH from VLAN10" -j ACCEPT
-A OUTPUT -o eth1+ -p tcp -m tcp --dport 22 -m comment --comment "Allow outgoing SSH" -j ACCEPT
-A INPUT -i eth1+ -p udp -m udp --dport 53 -m comment --comment "Allow incoming UDP DNS" -j ACCEPT
-A OUTPUT -o eth0 -p udp -m udp --dport 53 -m comment --comment "Allow outgoing UDP DNS" -j ACCEPT
-A INPUT -i eth1+ -p tcp -m tcp --dport 80 -m comment --comment "Allow incoming HTTP" -j ACCEPT
-A INPUT -i eth1+ -p tcp -m tcp --dport 443 -m comment --comment "Allow incoming HTTPS" -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 80 -m comment --comment "Allow outgoing HTTP" -j ACCEPT
-A OUTPUT -o eth0 -p tcp -m tcp --dport 443 -m comment --comment "Allow outgoing HTTPS" -j ACCEPT
-A FORWARD -i eth1+ -o eth0 -m comment --comment "Allow traffic from all internal (eth1+) to external (eth0)" -j ACCEPT
-A FORWARD -i eth0 -o eth1+ -m comment --comment "Allow traffic from all internal (eth1+) to external (eth0)" -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j LOGGING
-A INPUT -p tcp --tcp-flags ALL ALL -j LOGGING
-A INPUT -p tcp --tcp-flags ALL NONE -j LOGGING
-A INPUT -f -j LOGGING
-A INPUT -j LOGGING
-A OUTPUT -j LOGGING
-A LOGGING -m limit --limit 5/minute -j LOG --log-prefix "ipt-dropped: " --log-level 7
-A LOGGING -j DROP
COMMIT

*mangle
:PREROUTING ACCEPT [4:1084]
:INPUT ACCEPT [4:1084]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1:76]
:POSTROUTING ACCEPT [1:76]
COMMIT

So, you can see there's no rule (i think) allowing tcp/993.

With tcpdump:

13:20:13.683689 IP 64.90.62.162.993 > 10.10.10.12.62264: Flags [P.], seq 6234:6288, ack 735, win 236, length 54
13:20:13.687844 IP 10.10.10.12.62264 > 64.90.62.162.993: Flags [P.], seq 735:792, ack 6288, win 515, length 57
13:20:13.913290 IP 64.90.62.162.993 > 10.10.10.12.62264: Flags [P.], seq 6288:6651, ack 792, win 236, length 363
13:20:13.916872 IP 10.10.10.12.62264 > 64.90.62.162.993: Flags [P.], seq 792:832, ack 6651, win 514, length 40

Is there some think I'm mistaking in my rules?

Hope anybody help me.

Regards. Rafael.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.