* Ports opened without request
@ 2004-02-25 17:01 Sasa Stupar
2004-02-25 19:24 ` SV: " Sven-Ake Larsson
0 siblings, 1 reply; 5+ messages in thread
From: Sasa Stupar @ 2004-02-25 17:01 UTC (permalink / raw)
To: netfilter
Hi!
I have linux RH8 with kernel 2.4.20-28.8, iptables v1.2.8. I have setup
a firewall with some tcp ports opened (21,25,80,110,443) for servers.
Then I have ran a port scan and scanned all 65535 tcp and udp ports. I
was suprised that 3 ports were opened even if I didn't opened them in
the configuration. These ports are tcp 389,1002 and 1720.
I have tried to block them manually by entering a drop command for these
three ports but no success-they are still open.
What am I missing here? Is this some problem with iptables?
Sasa
^ permalink raw reply [flat|nested] 5+ messages in thread
* SV: Ports opened without request
2004-02-25 17:01 Ports opened without request Sasa Stupar
@ 2004-02-25 19:24 ` Sven-Ake Larsson
2004-02-26 12:24 ` Sasa Stupar
0 siblings, 1 reply; 5+ messages in thread
From: Sven-Ake Larsson @ 2004-02-25 19:24 UTC (permalink / raw)
To: netfilter
How did you make scan, from the machine itself or from another machine on
the outside? Some rulesets doesn't really work when you are at the same
machine.
Do you allow any ICMP packets? If so, try to drop them too and scan the
machine again.
What is your current ruleset? It helps a lot if you can add it to the list.
I believe you'll have the masters answers soon... ;-)
Regards,
S
-----Ursprungligt meddelande-----
Fran: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]För Sasa Stupar
Skickat: den 25 februari 2004 18:01
Till: netfilter@lists.netfilter.org
Ämne: Ports opened without request
Hi!
I have linux RH8 with kernel 2.4.20-28.8, iptables v1.2.8. I have setup
a firewall with some tcp ports opened (21,25,80,110,443) for servers.
Then I have ran a port scan and scanned all 65535 tcp and udp ports. I
was suprised that 3 ports were opened even if I didn't opened them in
the configuration. These ports are tcp 389,1002 and 1720.
I have tried to block them manually by entering a drop command for these
three ports but no success-they are still open.
What am I missing here? Is this some problem with iptables?
Sasa
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: SV: Ports opened without request
2004-02-25 19:24 ` SV: " Sven-Ake Larsson
@ 2004-02-26 12:24 ` Sasa Stupar
2004-02-26 13:09 ` Ray Leach
0 siblings, 1 reply; 5+ messages in thread
From: Sasa Stupar @ 2004-02-26 12:24 UTC (permalink / raw)
To: Netfilter-List
I have scanned from another machine. Yes, I allow ICMP packets. I have
droped them and rescanned the machine but still the same issue.
My current ruleset is:
---------------------
# Generated by webmin
*filter
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:INPUT DROP [0:0]
# Loopback
-A OUTPUT -o lo -j ACCEPT
# Allow self access by loopback interface
-A INPUT -i lo -j ACCEPT
# Accept established connections
-A INPUT -m state -i eth0 --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp -m tcp ! --tcp-option 2 -j REJECT --reject-with tcp-reset
# FTP
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
# Telnet
-A INPUT -p tcp -m tcp --dport 23 -j ACCEPT
# SMTP
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
# NTP
-A INPUT -p tcp -m tcp --dport 37 -j ACCEPT
# DNS
-A INPUT -p udp -m udp -s 192.168.10.111 -d 0/0 --sport 53 -j ACCEPT
# HTTP
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT --syn
# POP3
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
# Samba
-A INPUT -p udp -m udp --dport 137 -j ACCEPT
# Samba
-A INPUT -p udp -m udp --dport 138 -j ACCEPT
# Samba
-A INPUT -p tcp -m tcp --dport 139 -j ACCEPT --syn
# HTTPS
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
# SMTP-SSL
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
# POP3-SSL
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
# Squid Proxy
-A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT
# Xmail CtrlClnt
-A INPUT -p tcp -m tcp --dport 6017 -j ACCEPT
# XQM agent
-A INPUT -p tcp -m tcp --dport 8888 -j ACCEPT
# Webmin
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
# Drop all other connection attempts
-A INPUT -j DROP
COMMIT
# Generated by webmin
*mangle
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
COMMIT
# Completed
# Generated by webmin
*nat
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
COMMIT
# Completed
------------------------
As you can see I have made this rules with webmin.
Any hints what is wrong here? BTW I am very very new at firewall.
Sasa
Sven-Ake Larsson pravi:
>How did you make scan, from the machine itself or from another machine on
>the outside? Some rulesets doesn't really work when you are at the same
>machine.
>Do you allow any ICMP packets? If so, try to drop them too and scan the
>machine again.
>What is your current ruleset? It helps a lot if you can add it to the list.
>
>I believe you'll have the masters answers soon... ;-)
>
>Regards,
>S
>
>-----Ursprungligt meddelande-----
>Fran: netfilter-admin@lists.netfilter.org
>[mailto:netfilter-admin@lists.netfilter.org]För Sasa Stupar
>Skickat: den 25 februari 2004 18:01
>Till: netfilter@lists.netfilter.org
>Ämne: Ports opened without request
>
>
>Hi!
>
>I have linux RH8 with kernel 2.4.20-28.8, iptables v1.2.8. I have setup
>a firewall with some tcp ports opened (21,25,80,110,443) for servers.
>Then I have ran a port scan and scanned all 65535 tcp and udp ports. I
>was suprised that 3 ports were opened even if I didn't opened them in
>the configuration. These ports are tcp 389,1002 and 1720.
>I have tried to block them manually by entering a drop command for these
>three ports but no success-they are still open.
>What am I missing here? Is this some problem with iptables?
>
>Sasa
>
>
>
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: SV: Ports opened without request
2004-02-26 12:24 ` Sasa Stupar
@ 2004-02-26 13:09 ` Ray Leach
2004-02-26 13:48 ` Sasa Stupar
0 siblings, 1 reply; 5+ messages in thread
From: Ray Leach @ 2004-02-26 13:09 UTC (permalink / raw)
To: Netfilter Mailing List
[-- Attachment #1: Type: text/plain, Size: 3955 bytes --]
Your default policy on the FORWARD chain is accept.
On Thu, 2004-02-26 at 14:24, Sasa Stupar wrote:
> I have scanned from another machine. Yes, I allow ICMP packets. I have
> droped them and rescanned the machine but still the same issue.
> My current ruleset is:
> ---------------------
> # Generated by webmin
> *filter
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> :INPUT DROP [0:0]
> # Loopback
> -A OUTPUT -o lo -j ACCEPT
> # Allow self access by loopback interface
> -A INPUT -i lo -j ACCEPT
> # Accept established connections
> -A INPUT -m state -i eth0 --state ESTABLISHED,RELATED -j ACCEPT
> -A INPUT -p tcp -m tcp ! --tcp-option 2 -j REJECT --reject-with tcp-reset
> # FTP
> -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
> # Telnet
> -A INPUT -p tcp -m tcp --dport 23 -j ACCEPT
> # SMTP
> -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
> # NTP
> -A INPUT -p tcp -m tcp --dport 37 -j ACCEPT
> # DNS
> -A INPUT -p udp -m udp -s 192.168.10.111 -d 0/0 --sport 53 -j ACCEPT
> # HTTP
> -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT --syn
> # POP3
> -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
> # Samba
> -A INPUT -p udp -m udp --dport 137 -j ACCEPT
> # Samba
> -A INPUT -p udp -m udp --dport 138 -j ACCEPT
> # Samba
> -A INPUT -p tcp -m tcp --dport 139 -j ACCEPT --syn
> # HTTPS
> -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
> # SMTP-SSL
> -A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
> # POP3-SSL
> -A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
> # Squid Proxy
> -A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT
> # Xmail CtrlClnt
> -A INPUT -p tcp -m tcp --dport 6017 -j ACCEPT
> # XQM agent
> -A INPUT -p tcp -m tcp --dport 8888 -j ACCEPT
> # Webmin
> -A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
> # Drop all other connection attempts
> -A INPUT -j DROP
> COMMIT
> # Generated by webmin
> *mangle
> :POSTROUTING ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> :PREROUTING ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :INPUT ACCEPT [0:0]
> COMMIT
> # Completed
> # Generated by webmin
> *nat
> :OUTPUT ACCEPT [0:0]
> :POSTROUTING ACCEPT [0:0]
> :PREROUTING ACCEPT [0:0]
> COMMIT
> # Completed
> ------------------------
>
> As you can see I have made this rules with webmin.
> Any hints what is wrong here? BTW I am very very new at firewall.
>
> Sasa
>
>
> Sven-Ake Larsson pravi:
>
> >How did you make scan, from the machine itself or from another machine on
> >the outside? Some rulesets doesn't really work when you are at the same
> >machine.
> >Do you allow any ICMP packets? If so, try to drop them too and scan the
> >machine again.
> >What is your current ruleset? It helps a lot if you can add it to the list.
> >
> >I believe you'll have the masters answers soon... ;-)
> >
> >Regards,
> >S
> >
> >-----Ursprungligt meddelande-----
> >Fran: netfilter-admin@lists.netfilter.org
> >[mailto:netfilter-admin@lists.netfilter.org]För Sasa Stupar
> >Skickat: den 25 februari 2004 18:01
> >Till: netfilter@lists.netfilter.org
> >Ämne: Ports opened without request
> >
> >
> >Hi!
> >
> >I have linux RH8 with kernel 2.4.20-28.8, iptables v1.2.8. I have setup
> >a firewall with some tcp ports opened (21,25,80,110,443) for servers.
> >Then I have ran a port scan and scanned all 65535 tcp and udp ports. I
> >was suprised that 3 ports were opened even if I didn't opened them in
> >the configuration. These ports are tcp 389,1002 and 1720.
> >I have tried to block them manually by entering a drop command for these
> >three ports but no success-they are still open.
> >What am I missing here? Is this some problem with iptables?
> >
> >Sasa
> >
> >
> >
> >
> >
>
>
>
--
--
Raymond Leach <raymondl@knowledgefactory.co.za>
Network Support Specialist
http://www.knowledgefactory.co.za
"lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import"
Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28
--
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: SV: Ports opened without request
2004-02-26 13:09 ` Ray Leach
@ 2004-02-26 13:48 ` Sasa Stupar
0 siblings, 0 replies; 5+ messages in thread
From: Sasa Stupar @ 2004-02-26 13:48 UTC (permalink / raw)
To: Netfilter-List
So I should change default policy to DROP on FORWARD chain for filter
only or also for mangle?
Ray Leach pravi:
>Your default policy on the FORWARD chain is accept.
>
>On Thu, 2004-02-26 at 14:24, Sasa Stupar wrote:
>
>
>>I have scanned from another machine. Yes, I allow ICMP packets. I have
>>droped them and rescanned the machine but still the same issue.
>>My current ruleset is:
>>---------------------
>># Generated by webmin
>>*filter
>>:FORWARD ACCEPT [0:0]
>>:OUTPUT ACCEPT [0:0]
>>:INPUT DROP [0:0]
>># Loopback
>>-A OUTPUT -o lo -j ACCEPT
>># Allow self access by loopback interface
>>-A INPUT -i lo -j ACCEPT
>># Accept established connections
>>-A INPUT -m state -i eth0 --state ESTABLISHED,RELATED -j ACCEPT
>>-A INPUT -p tcp -m tcp ! --tcp-option 2 -j REJECT --reject-with tcp-reset
>># FTP
>>-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
>># Telnet
>>-A INPUT -p tcp -m tcp --dport 23 -j ACCEPT
>># SMTP
>>-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
>># NTP
>>-A INPUT -p tcp -m tcp --dport 37 -j ACCEPT
>># DNS
>>-A INPUT -p udp -m udp -s 192.168.10.111 -d 0/0 --sport 53 -j ACCEPT
>># HTTP
>>-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT --syn
>># POP3
>>-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
>># Samba
>>-A INPUT -p udp -m udp --dport 137 -j ACCEPT
>># Samba
>>-A INPUT -p udp -m udp --dport 138 -j ACCEPT
>># Samba
>>-A INPUT -p tcp -m tcp --dport 139 -j ACCEPT --syn
>># HTTPS
>>-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
>># SMTP-SSL
>>-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
>># POP3-SSL
>>-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
>># Squid Proxy
>>-A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT
>># Xmail CtrlClnt
>>-A INPUT -p tcp -m tcp --dport 6017 -j ACCEPT
>># XQM agent
>>-A INPUT -p tcp -m tcp --dport 8888 -j ACCEPT
>># Webmin
>>-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
>># Drop all other connection attempts
>>-A INPUT -j DROP
>>COMMIT
>># Generated by webmin
>>*mangle
>>:POSTROUTING ACCEPT [0:0]
>>:OUTPUT ACCEPT [0:0]
>>:PREROUTING ACCEPT [0:0]
>>:FORWARD ACCEPT [0:0]
>>:INPUT ACCEPT [0:0]
>>COMMIT
>># Completed
>># Generated by webmin
>>*nat
>>:OUTPUT ACCEPT [0:0]
>>:POSTROUTING ACCEPT [0:0]
>>:PREROUTING ACCEPT [0:0]
>>COMMIT
>># Completed
>>------------------------
>>
>>As you can see I have made this rules with webmin.
>>Any hints what is wrong here? BTW I am very very new at firewall.
>>
>>Sasa
>>
>>
>>Sven-Ake Larsson pravi:
>>
>>
>>
>>>How did you make scan, from the machine itself or from another machine on
>>>the outside? Some rulesets doesn't really work when you are at the same
>>>machine.
>>>Do you allow any ICMP packets? If so, try to drop them too and scan the
>>>machine again.
>>>What is your current ruleset? It helps a lot if you can add it to the list.
>>>
>>>I believe you'll have the masters answers soon... ;-)
>>>
>>>Regards,
>>>S
>>>
>>>-----Ursprungligt meddelande-----
>>>Fran: netfilter-admin@lists.netfilter.org
>>>[mailto:netfilter-admin@lists.netfilter.org]För Sasa Stupar
>>>Skickat: den 25 februari 2004 18:01
>>>Till: netfilter@lists.netfilter.org
>>>Ämne: Ports opened without request
>>>
>>>
>>>Hi!
>>>
>>>I have linux RH8 with kernel 2.4.20-28.8, iptables v1.2.8. I have setup
>>>a firewall with some tcp ports opened (21,25,80,110,443) for servers.
>>>Then I have ran a port scan and scanned all 65535 tcp and udp ports. I
>>>was suprised that 3 ports were opened even if I didn't opened them in
>>>the configuration. These ports are tcp 389,1002 and 1720.
>>>I have tried to block them manually by entering a drop command for these
>>>three ports but no success-they are still open.
>>>What am I missing here? Is this some problem with iptables?
>>>
>>>Sasa
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>
>>
>>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2004-02-26 13:48 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-02-25 17:01 Ports opened without request Sasa Stupar
2004-02-25 19:24 ` SV: " Sven-Ake Larsson
2004-02-26 12:24 ` Sasa Stupar
2004-02-26 13:09 ` Ray Leach
2004-02-26 13:48 ` Sasa Stupar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox