Filtered Port

Filtered Port

[Scott Mayo]

I am not sure if this is my iptables or not, but I am not sure where 
else to look or ask.  I am trying to use Remote Desktop on a computer. 
 From inside my network, it works fine, but once I get outside, I cannot 
use it.  I have set my IPTABLES to forward anything going to port 3389 
to the computer that is using Remote Desktop.

The problems seems to be that port 3389 is filtered.  I can find nothing 
in my iptables where I have this port filtered.  Are there some generic 
ports, that IPTABLES filters on it own or something?  If the IPTABLES 
are not filtering it, what else could be?

Thanks.

-- 
Scott Mayo
Technology Coordinator
Bloomfield Schools
PH: 573-568-5669
FA: 573-568-4565
Pager: 800-264-2535 X2549

Duct tape is like the force, it has a light side and a dark side and it
holds the universe together.

Re: Filtered Port

[Rob Sterenborg]

On Tue, January 31, 2006 14:55, Scott Mayo wrote:
> I am not sure if this is my iptables or not, but I am not sure where
> else to look or ask.  I am trying to use Remote Desktop on a
> computer.  From inside my network, it works fine, but once I get
> outside, I cannot use it.  I have set my IPTABLES to forward anything
> going to port 3389 to the computer that is using Remote Desktop.
>
> The problems seems to be that port 3389 is filtered.  I can find
> nothing in my iptables where I have this port filtered.  Are there
> some generic ports, that IPTABLES filters on it own or something?  If
> the IPTABLES are not filtering it, what else could be?

You allow forwarding to this host but you also need to DNAT these
packets from the internet IP to the IP of your computer.

$ipt -t nat -A PREROUTING -i <if_inet> -d <ip_inet> \
  -p tcp --dport 3389 -j DNAT --to <ip_controlled_host>


Gr,
Rob

Re: Filtered Port

[Robby Workman]

Rob Sterenborg wrote:
> On Tue, January 31, 2006 14:55, Scott Mayo wrote:
>> I am not sure if this is my iptables or not, but I am not sure where
>> else to look or ask.  I am trying to use Remote Desktop on a
>> computer.  From inside my network, it works fine, but once I get
>> outside, I cannot use it.  I have set my IPTABLES to forward anything
>> going to port 3389 to the computer that is using Remote Desktop.
>>
>> The problems seems to be that port 3389 is filtered.  I can find
>> nothing in my iptables where I have this port filtered.  Are there
>> some generic ports, that IPTABLES filters on it own or something?  If
>> the IPTABLES are not filtering it, what else could be?
> 
> You allow forwarding to this host but you also need to DNAT these
> packets from the internet IP to the IP of your computer.
> 
> $ipt -t nat -A PREROUTING -i <if_inet> -d <ip_inet> \
>   -p tcp --dport 3389 -j DNAT --to <ip_controlled_host>

<apology>Rob, sorry for sending this to you first - I always forget to
fix that...</apology>

If it still doesn't work, it's quite possible that your ISP is filtering 
  that port upstream of you.

RW

-- 

http://rlworkman.net

Re: Filtered Port

[Scott Mayo]

Robby Workman wrote:
> Rob Sterenborg wrote:
> 
>> On Tue, January 31, 2006 14:55, Scott Mayo wrote:
>>
>>> I am not sure if this is my iptables or not, but I am not sure where
>>> else to look or ask.  I am trying to use Remote Desktop on a
>>> computer.  From inside my network, it works fine, but once I get
>>> outside, I cannot use it.  I have set my IPTABLES to forward anything
>>> going to port 3389 to the computer that is using Remote Desktop.
>>>
>>> The problems seems to be that port 3389 is filtered.  I can find
>>> nothing in my iptables where I have this port filtered.  Are there
>>> some generic ports, that IPTABLES filters on it own or something?  If
>>> the IPTABLES are not filtering it, what else could be?
>>
>>
>> You allow forwarding to this host but you also need to DNAT these
>> packets from the internet IP to the IP of your computer.
>>
>> $ipt -t nat -A PREROUTING -i <if_inet> -d <ip_inet> \
>>   -p tcp --dport 3389 -j DNAT --to <ip_controlled_host>
> 
> 
> <apology>Rob, sorry for sending this to you first - I always forget to
> fix that...</apology>
> 
> If it still doesn't work, it's quite possible that your ISP is filtering 
>  that port upstream of you.
> 
> RW
> 

But I get on the server itself and do an nmap from itself, and it shows 
that it is filtered.  If the ISP was filtering, would NMAP still show that?

-- 
Scott Mayo
Technology Coordinator
Bloomfield Schools
PH: 573-568-5669
FA: 573-568-4565
Pager: 800-264-2535 X2549

Duct tape is like the force, it has a light side and a dark side and it
holds the universe together.

Re: Filtered Port

[Scott Mayo]

Rob Sterenborg wrote:
> On Tue, January 31, 2006 14:55, Scott Mayo wrote:
> 
>>I am not sure if this is my iptables or not, but I am not sure where
>>else to look or ask.  I am trying to use Remote Desktop on a
>>computer.  From inside my network, it works fine, but once I get
>>outside, I cannot use it.  I have set my IPTABLES to forward anything
>>going to port 3389 to the computer that is using Remote Desktop.
>>
>>The problems seems to be that port 3389 is filtered.  I can find
>>nothing in my iptables where I have this port filtered.  Are there
>>some generic ports, that IPTABLES filters on it own or something?  If
>>the IPTABLES are not filtering it, what else could be?
> 
> 
> You allow forwarding to this host but you also need to DNAT these
> packets from the internet IP to the IP of your computer.
> 
> $ipt -t nat -A PREROUTING -i <if_inet> -d <ip_inet> \
>   -p tcp --dport 3389 -j DNAT --to <ip_controlled_host>
> 

Maybe I used the wrong word when I said 'forward'.  This is the rule 
that I have in place and it does not seem to be working.  I assumed that 
it was because the port is filtered, or that is what NMAP tells me when 
I run it.

I still have no idea why port 3389 is shown as being filtered.  I have 
no rules in my iptables that explicitly filter it.

-- 
Scott Mayo
Technology Coordinator
Bloomfield Schools
PH: 573-568-5669
FA: 573-568-4565
Pager: 800-264-2535 X2549

Duct tape is like the force, it has a light side and a dark side and it
holds the universe together.

Re: Filtered Port

[/dev/rob0]

On Tuesday 2006-January-31 08:17, Scott Mayo wrote:
> I still have no idea why port 3389 is shown as being filtered.  I
> have no rules in my iptables that explicitly filter it.

This is normal for a forwarded port which cannot get replies back to  
the originator. Closed means you get an icmp-port-unreachable reply 
back. Open means the SYN/ACK connection negotiation succeeds (although 
with a stealth scan you do not complete the negotiation.) Filtered 
means ... anything else. You don't get anything back.
-- 
    Offlist mail to this address is discarded unless
    "/dev/rob0" or "not-spam" is in Subject: header

Re: Filtered Port

[Rob Sterenborg]

On Tue, January 31, 2006 15:17, Scott Mayo wrote:
> Rob Sterenborg wrote:
>> On Tue, January 31, 2006 14:55, Scott Mayo wrote:
>>
>>>I am not sure if this is my iptables or not, but I am not sure where
>>>else to look or ask.  I am trying to use Remote Desktop on a
>>>computer.  From inside my network, it works fine, but once I get
>>>outside, I cannot use it.  I have set my IPTABLES to forward
>>> anything
>>>going to port 3389 to the computer that is using Remote Desktop.
>>>
>>>The problems seems to be that port 3389 is filtered.  I can find
>>>nothing in my iptables where I have this port filtered.  Are there
>>>some generic ports, that IPTABLES filters on it own or something?
>>> If
>>>the IPTABLES are not filtering it, what else could be?
>>
>>
>> You allow forwarding to this host but you also need to DNAT these
>> packets from the internet IP to the IP of your computer.
>>
>> $ipt -t nat -A PREROUTING -i <if_inet> -d <ip_inet> \
>>   -p tcp --dport 3389 -j DNAT --to <ip_controlled_host>
>>
>
> Maybe I used the wrong word when I said 'forward'.  This is the rule
> that I have in place and it does not seem to be working.  I assumed
> that it was because the port is filtered, or that is what NMAP tells
> me when I run it.
>
> I still have no idea why port 3389 is shown as being filtered.  I
> have no rules in my iptables that explicitly filter it.

In that case you may want to allow forwarding ;-)..

$ipt -A FORWARD -i <if_inet> -o <if_lan> -d <ip_controlled_host> \
  -p tcp --dport 3389 -j ACCEPT

or set the policy of the FORWARD chain to ACCEPT, but personally I
think that is a bad idea...


Gr,
Rob

Re: Filtered Port

[Scott Mayo]

Rob Sterenborg wrote:
> On Tue, January 31, 2006 15:17, Scott Mayo wrote:
> 
>>Rob Sterenborg wrote:
>>
>>>On Tue, January 31, 2006 14:55, Scott Mayo wrote:
>>>
>>>
>>>>I am not sure if this is my iptables or not, but I am not sure where
>>>>else to look or ask.  I am trying to use Remote Desktop on a
>>>>computer.  From inside my network, it works fine, but once I get
>>>>outside, I cannot use it.  I have set my IPTABLES to forward
>>>>anything
>>>>going to port 3389 to the computer that is using Remote Desktop.
>>>>
>>>>The problems seems to be that port 3389 is filtered.  I can find
>>>>nothing in my iptables where I have this port filtered.  Are there
>>>>some generic ports, that IPTABLES filters on it own or something?
>>>>If
>>>>the IPTABLES are not filtering it, what else could be?
>>>
>>>
>>>You allow forwarding to this host but you also need to DNAT these
>>>packets from the internet IP to the IP of your computer.
>>>
>>>$ipt -t nat -A PREROUTING -i <if_inet> -d <ip_inet> \
>>>  -p tcp --dport 3389 -j DNAT --to <ip_controlled_host>
>>>
>>Maybe I used the wrong word when I said 'forward'.  This is the rule
>>that I have in place and it does not seem to be working.  I assumed
>>that it was because the port is filtered, or that is what NMAP tells
>>me when I run it.
>>
>>I still have no idea why port 3389 is shown as being filtered.  I
>>have no rules in my iptables that explicitly filter it.
> 
> 
> In that case you may want to allow forwarding ;-)..
> 
> $ipt -A FORWARD -i <if_inet> -o <if_lan> -d <ip_controlled_host> \
>   -p tcp --dport 3389 -j ACCEPT
> 

This did not let it go through either.  It must not be the iptables 
causing it.  I took everything out of my rules except for the PREROUTING 
rule above and my POSTROUTING rule for SNAT and I am getting the same thing.

I am not sure what else would be blocking this, unless it is the 
upstream ISP.  I don't think it is, but I have sent them an email to 
make sure.  Only thing this machine is used for is to be a filter using 
IPTABLES, Squid and Dansguardian.

Hopefully it has something to do with my ISP, but I really doubt it.

Thanks for the help.

-- 
Scott Mayo
Technology Coordinator
Bloomfield Schools
PH: 573-568-5669
FA: 573-568-4565
Pager: 800-264-2535 X2549

Duct tape is like the force, it has a light side and a dark side and it
holds the universe together.

Re: Filtered Port

[Robby Workman]

Scott Mayo wrote:
> Rob Sterenborg wrote:
>> In that case you may want to allow forwarding ;-)..
>>
>> $ipt -A FORWARD -i <if_inet> -o <if_lan> -d <ip_controlled_host> \
>>   -p tcp --dport 3389 -j ACCEPT
>>
> 
> This did not let it go through either.  It must not be the iptables 
> causing it.  I took everything out of my rules except for the PREROUTING 
> rule above and my POSTROUTING rule for SNAT and I am getting the same 
> thing.
> 
> I am not sure what else would be blocking this, unless it is the 
> upstream ISP.  I don't think it is, but I have sent them an email to 
> make sure.  Only thing this machine is used for is to be a filter using 
> IPTABLES, Squid and Dansguardian.


Scott:

Are the counters showing any packets hitting those rules?

RW

-- 

http://rlworkman.net

Re: Filtered Port

[Robb Bossley]

Scott,

Instead of toying with your firewall rules and opening up ports, if
you are the only one using this, try an ssh tunnel.  "ssh -L
3389:<destinationaddress>:3389 <yourrouteraddress>"

Then just remote desktop to localhost:3389.  It is encrypted and
solves the issue of opening up a hole in the firewall.

Robb

On 1/31/06, Scott Mayo <sgmayo@mail.bloomfield.k12.mo.us> wrote:
> Rob Sterenborg wrote:
> > On Tue, January 31, 2006 15:17, Scott Mayo wrote:
> >
> >>Rob Sterenborg wrote:
> >>
> >>>On Tue, January 31, 2006 14:55, Scott Mayo wrote:
> >>>
> >>>
> >>>>I am not sure if this is my iptables or not, but I am not sure where
> >>>>else to look or ask.  I am trying to use Remote Desktop on a
> >>>>computer.  From inside my network, it works fine, but once I get
> >>>>outside, I cannot use it.  I have set my IPTABLES to forward
> >>>>anything
> >>>>going to port 3389 to the computer that is using Remote Desktop.
> >>>>
> >>>>The problems seems to be that port 3389 is filtered.  I can find
> >>>>nothing in my iptables where I have this port filtered.  Are there
> >>>>some generic ports, that IPTABLES filters on it own or something?
> >>>>If
> >>>>the IPTABLES are not filtering it, what else could be?
> >>>
> >>>
> >>>You allow forwarding to this host but you also need to DNAT these
> >>>packets from the internet IP to the IP of your computer.
> >>>
> >>>$ipt -t nat -A PREROUTING -i <if_inet> -d <ip_inet> \
> >>>  -p tcp --dport 3389 -j DNAT --to <ip_controlled_host>
> >>>
> >>Maybe I used the wrong word when I said 'forward'.  This is the rule
> >>that I have in place and it does not seem to be working.  I assumed
> >>that it was because the port is filtered, or that is what NMAP tells
> >>me when I run it.
> >>
> >>I still have no idea why port 3389 is shown as being filtered.  I
> >>have no rules in my iptables that explicitly filter it.
> >
> >
> > In that case you may want to allow forwarding ;-)..
> >
> > $ipt -A FORWARD -i <if_inet> -o <if_lan> -d <ip_controlled_host> \
> >   -p tcp --dport 3389 -j ACCEPT
> >
>
> This did not let it go through either.  It must not be the iptables
> causing it.  I took everything out of my rules except for the PREROUTING
> rule above and my POSTROUTING rule for SNAT and I am getting the same thing.
>
> I am not sure what else would be blocking this, unless it is the
> upstream ISP.  I don't think it is, but I have sent them an email to
> make sure.  Only thing this machine is used for is to be a filter using
> IPTABLES, Squid and Dansguardian.
>
> Hopefully it has something to do with my ISP, but I really doubt it.
>
> Thanks for the help.
>
> --
> Scott Mayo
> Technology Coordinator
> Bloomfield Schools
> PH: 573-568-5669
> FA: 573-568-4565
> Pager: 800-264-2535 X2549
>
> Duct tape is like the force, it has a light side and a dark side and it
> holds the universe together.
>
>

Re: Filtered Port

[/dev/rob0]

On Tuesday 2006-January-31 07:55, Scott Mayo wrote:
> else to look or ask.  I am trying to use Remote Desktop on a
> computer. From inside my network, it works fine, but once I get
> outside, I cannot use it.  I have set my IPTABLES to forward anything
> going to port 3389 to the computer that is using Remote Desktop.

Is the iptables machine the default gateway for the Remote Desktop 
machine? When in doubt check the routing. Then check the routing 
again. :)
-- 
    Offlist mail to this address is discarded unless
    "/dev/rob0" or "not-spam" is in Subject: header

Re: Filtered Port

[Scott Mayo]

/dev/rob0 wrote:
> On Tuesday 2006-January-31 07:55, Scott Mayo wrote:
> 
>>else to look or ask.  I am trying to use Remote Desktop on a
>>computer. From inside my network, it works fine, but once I get
>>outside, I cannot use it.  I have set my IPTABLES to forward anything
>>going to port 3389 to the computer that is using Remote Desktop.
> 
> 
> Is the iptables machine the default gateway for the Remote Desktop 
> machine? When in doubt check the routing. Then check the routing 
> again. :)

Yes this is my firewall.  All traffic goes through this machine.

-- 
Scott Mayo
Technology Coordinator
Bloomfield Schools
PH: 573-568-5669
FA: 573-568-4565
Pager: 800-264-2535 X2549

Duct tape is like the force, it has a light side and a dark side and it
holds the universe together.

Re: Filtered Port

[Burak Ozgoren]

I have another rule after preouting,   postrouting snat (for the firewall 
itself) for that purpose. Packets coming from outside going to inside 
machine as from firewall machine.

May be helps.






Scott Mayo <sgmayo@mail.bloomfield.k12.mo.us> 
Sent by: netfilter-bounces@lists.netfilter.org
31.01.2006 15:55
Please respond to
sgmayo@mail.bloomfield.k12.mo.us


To
netfilter@lists.netfilter.org
cc

Subject
Filtered Port






***********************
Your mail has been scanned by InterScan VirusWall.
***********-***********


I am not sure if this is my iptables or not, but I am not sure where 
else to look or ask.  I am trying to use Remote Desktop on a computer. 
 From inside my network, it works fine, but once I get outside, I cannot 
use it.  I have set my IPTABLES to forward anything going to port 3389 
to the computer that is using Remote Desktop.

The problems seems to be that port 3389 is filtered.  I can find nothing 
in my iptables where I have this port filtered.  Are there some generic 
ports, that IPTABLES filters on it own or something?  If the IPTABLES 
are not filtering it, what else could be?

Thanks.

-- 
Scott Mayo
Technology Coordinator
Bloomfield Schools
PH: 573-568-5669
FA: 573-568-4565
Pager: 800-264-2535 X2549

Duct tape is like the force, it has a light side and a dark side and it
holds the universe together.

RE: Filtered Port

[Rob Sterenborg]

> I have another rule after preouting,   postrouting snat (for
> the firewall
> itself) for that purpose. Packets coming from outside going to inside
> machine as from firewall machine.
> 
> May be helps.

If you accept ESTABLISHED (and RELATED for simplicity and other
functionality) you don't have to ; only a PREROUTING will do the trick.
What I mean is this :

$ipt -P FORWARD DROP
$ipt -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$ipt -A FORWARD -m state --state NEW -i <if_inet> -o <if_lan> \
  -d <ip_rdp_host> -p tcp --dport 3389 -j ACCEPT
$ipt -t nat -A PREROUTING -i <if_inet> -p tcp --dport 3389 \
  -j DNAT --to <ip_rdp_host>

Robby Workman also has a point : does "iptables -nvL" show packetcount
for these rules. Maybe the packets never reach the iptables firewall, or
maybe there is some other rule blocking rdp traffic before it can be
accepted.


Gr,
Rob