[SOLVED] Can't configure iptables

[somethin]

I can't understand how to configure iptables.
I use the following script to configure it:

[szatox]

[somethin]

...So, Do I need to run "nmap localhost" or "nmap 192.168.0.100" ?

[somethin]

Btw, I can acces internet with web browser, so port 80 is still open.

[cboldt]

You should scan your computer from an unrelated network, if you want to see what is open to others on unrelated networks.

http://www.whatsmyip.org/port-scanner/ has a selection of scanning routines.

[somethin]

1. http://www.whatsmyip.org/port-scanner/ show that ports 53,80,1723,,8001,8009,8291 are open.
2. Here is an experiment:

[cboldt]

[somethin]

1. sudo iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT should allow traffic that is already ESTABLISHED or RELATED to established connection. There is different state for NEW connections. See man iptables-extensions(8 ).
2. netstat -tua before applying rule right after the reboot shows only udp 0 0 0.0.0.0:bootpc 0.0.0.0:* .

[cboldt]

So far, so good. When you open chromium, or another browser, and hook up to a website or three, you will have connections between the firewalled computer and http/https ports at the websites.

Still a mystery as to what is opening that handful of ports (53,80,1723,,8001,8009,8291), but `netstat -tuap`will show what is running on the firewalled machine, that might be LISTENING for packets destined for those ports. Your router might offer some ports to the outside world too.

[somethin]

Just to clarify the problem.
What I do:

[cboldt]

How do you reach the conclusion that any port is open?

If you leave the firewall in the condition you just described, and use the port scanner form an external website, any ports that the port scanner sees are NOT on the computer running the firewall. You can prove that with `netstat -tua`.

If you want all the ports to the outside closed, including RELATED and ESTABLISHED connections, you won't be able to do much on the external network.

[somethin]

Well, when I leave the firewall in the condition I just described, I am able to use web browser to load any page, which means ports 80 and 443 are open and can be further proven with netstat -tua.

And, why open ports determined via port scanner are NOT on my computer, which is running firewall ?

[cboldt]

From the `netstat -tua` lines you gave before, ports 80 and 443 are open on the HOST computer (website server, "Foreign address" column in the netstat report), not the computer that the browser/firewall are running on (Local address).

We haven't figured out why ports 53,80,1723,8001,8009,8291 are shown as open when you probe from the outside, but if those ports don't show up in the "Local address" column of `netstat -tua`, then those ports aren't open on your computer.

Where are they open? Well, your router is a separate computer, and you are going to have to learn how to read its configuration. On the system I have here, the router can forward certain NEW packets to any computer I choose, on the local network. My router forwards SSH packets to one computer on the inside, and forwards TELNET and FTP packets to a separate machine that runs as a honeypot (no telnet or ftp service running, but the packets come through - persistent attempts result in closing the firewall to blocks of IP address). When I portscan from the outside, it looks like the system has live TELNET and FTP services, the ports are opern, but there is nobody home (`netstat -tua` shows no open TELNET or FTP port, no service running there).

[Ant P.]

[szatox]

[somethin]

Ok, thanks, I understand now. And, I guess, open ports are because of the router.