From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasa Stupar Subject: Re: SV: Ports opened without request Date: Thu, 26 Feb 2004 13:24:36 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <403DE584.7020704@stupar.homelinux.net> References: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1"; format="flowed" To: Netfilter-List I have scanned from another machine. Yes, I allow ICMP packets. I have droped them and rescanned the machine but still the same issue. My current ruleset is: --------------------- # Generated by webmin *filter :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :INPUT DROP [0:0] # Loopback -A OUTPUT -o lo -j ACCEPT # Allow self access by loopback interface -A INPUT -i lo -j ACCEPT # Accept established connections -A INPUT -m state -i eth0 --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p tcp -m tcp ! --tcp-option 2 -j REJECT --reject-with tcp-reset # FTP -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT # Telnet -A INPUT -p tcp -m tcp --dport 23 -j ACCEPT # SMTP -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT # NTP -A INPUT -p tcp -m tcp --dport 37 -j ACCEPT # DNS -A INPUT -p udp -m udp -s 192.168.10.111 -d 0/0 --sport 53 -j ACCEPT # HTTP -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT --syn # POP3 -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT # Samba -A INPUT -p udp -m udp --dport 137 -j ACCEPT # Samba -A INPUT -p udp -m udp --dport 138 -j ACCEPT # Samba -A INPUT -p tcp -m tcp --dport 139 -j ACCEPT --syn # HTTPS -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT # SMTP-SSL -A INPUT -p tcp -m tcp --dport 465 -j ACCEPT # POP3-SSL -A INPUT -p tcp -m tcp --dport 995 -j ACCEPT # Squid Proxy -A INPUT -p tcp -m tcp --dport 3128 -j ACCEPT # Xmail CtrlClnt -A INPUT -p tcp -m tcp --dport 6017 -j ACCEPT # XQM agent -A INPUT -p tcp -m tcp --dport 8888 -j ACCEPT # Webmin -A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT # Drop all other connection attempts -A INPUT -j DROP COMMIT # Generated by webmin *mangle :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :PREROUTING ACCEPT [0:0] :FORWARD ACCEPT [0:0] :INPUT ACCEPT [0:0] COMMIT # Completed # Generated by webmin *nat :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :PREROUTING ACCEPT [0:0] COMMIT # Completed ------------------------ As you can see I have made this rules with webmin. Any hints what is wrong here? BTW I am very very new at firewall. Sasa Sven-Ake Larsson pravi: >How did you make scan, from the machine itself or from another machine o= n >the outside? Some rulesets doesn't really work when you are at the same >machine. >Do you allow any ICMP packets? If so, try to drop them too and scan the >machine again. >What is your current ruleset? It helps a lot if you can add it to the li= st. > >I believe you'll have the masters answers soon... ;-) > >Regards, >S > >-----Ursprungligt meddelande----- >Fran: netfilter-admin@lists.netfilter.org >[mailto:netfilter-admin@lists.netfilter.org]F=F6r Sasa Stupar >Skickat: den 25 februari 2004 18:01 >Till: netfilter@lists.netfilter.org >=C4mne: Ports opened without request > > >Hi! > >I have linux RH8 with kernel 2.4.20-28.8, iptables v1.2.8. I have setup >a firewall with some tcp ports opened (21,25,80,110,443) for servers. >Then I have ran a port scan and scanned all 65535 tcp and udp ports. I >was suprised that 3 ports were opened even if I didn't opened them in >the configuration. These ports are tcp 389,1002 and 1720. >I have tried to block them manually by entering a drop command for these >three ports but no success-they are still open. >What am I missing here? Is this some problem with iptables? > >Sasa > > > > =20 >