IPTables blocks all incoming traffic from other networks

Question

Angusm 0 Newbie Poster

19 Years Ago

My DNS server has a Firestarter firewall. When the firewall runs, only addresses on the same network as the DNS server can get a response from DNS/FTP/SSH. When I boot without the firewall, anyone can access them - as well as everything else!.

This is my first foray into IPTables, but the following IPTables entries should, I believe, allow access from anyone to DNS, SSH and FTP:

ACCEPT tcp -- xx.yyy.zz.128/26 tcp dpt:20 flags:!0x16/0x02
ACCEPT tcp -- xx.yyy.zz.128/26 tcp dpt:21
ACCEPT tcp -- xx.yyy.zz.128/26 tcp dpt:22
ACCEPT tcp -- xx.yyy.zz.128/26 tcp dpt:53
ACCEPT udp -- xx.yyy.zz.128/26 udp dpt:53

Something else must be blocking access from outside of and there is a lot in the tables that I do not understand. Below is the output from iptables -L -n (I removed some entries I feel do not contribute to the issue). Can someone tell me what causes the blockage?

Thanks,

Angus.

ns2:/sbin# ./iptables -L -n
Chain INPUT (policy DROP)
target prot opt source destination
UNCLEAN all -- unclean
ACCEPT tcp -- tcp flags:!0x16/0x02
ACCEPT udp --
ACCEPT all --
ACCEPT icmp -- xx.yyy.zz.128/26 limit: avg 10/sec burst 5
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26

... more similar nnn.0.0.0/8 entries are here ...

LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD all -- xx.yyy.zz.128/26
LD tcp -- xx.yyy.zz.128/26 tcp dpt:31337 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpt:31337 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:33270 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpt:33270 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:1234 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:6711 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:16660 flags:0x16/0x02 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:60001 flags:0x16/0x02 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpts:12345:12346 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpts:12345:12346 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:135 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpt:135 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:1524 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:27665 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpt:27444 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpt:31335 limit: avg 2/min burst 5
LD all --
LD all --
LD all --
LD all --
DROP all --
DROP all --
DROP all --
DROP all --
LD all -- state INVALID
LD all -f limit: avg 10/min burst 5
ACCEPT tcp -- xx.yyy.zz.128/26 tcp dpt:20 flags:!0x16/0x02
ACCEPT tcp -- xx.yyy.zz.128/26 tcp dpt:21
ACCEPT tcp -- xx.yyy.zz.128/26 tcp dpt:22
ACCEPT tcp -- xx.yyy.zz.128/26 tcp dpt:53
ACCEPT udp -- xx.yyy.zz.128/26 udp dpt:53
LD tcp -- tcp flags:!0x16/0x02 state NEW
ACCEPT tcp -- tcp spt:22 dpts:513:65535 flags:!0x16/0x02 state RELATED
ACCEPT tcp -- tcp spt:20 dpts:1023:65535 flags:!0x16/0x02 state RELATED
STATE tcp -- xx.yyy.zz.128/26 tcp dpts:1024:65535
ACCEPT udp -- xx.yyy.zz.128/26 udp dpts:1023:65535
LD all --

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy DROP)
target prot opt source destination
UNCLEAN all -- unclean
ACCEPT all --
LD tcp -- xx.yyy.zz.128/26 tcp dpt:31337 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpt:31337 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:33270 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpt:33270 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:1234 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:6711 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:16660 flags:0x16/0x02 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:60001 flags:0x16/0x02 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpts:12345:12346 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpts:12345:12346 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:135 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpt:135 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:1524 limit: avg 2/min burst 5
LD tcp -- xx.yyy.zz.128/26 tcp dpt:27665 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpt:27444 limit: avg 2/min burst 5
LD udp -- xx.yyy.zz.128/26 udp dpt:31335 limit: avg 2/min burst 5
LD all --
LD all --
LD all --
LD all --
DROP tcp -- tcp flags:!0x16/0x02 state NEW
all -- TTL match TTL == 64
ACCEPT icmp -- xx.yyy.zz.128/26
ACCEPT all --

Chain LD (146 references)
target prot opt source destination
LOG all -- LOG flags 0 level 4
DROP all --

Chain SANITY (0 references)
target prot opt source destination
LD all --

Chain STATE (1 references)
target prot opt source destination
LD all -- state NEW
ACCEPT all -- state RELATED,ESTABLISHED
LD all --

Chain UNCLEAN (2 references)
target prot opt source destination
LD all --
ns2:/sbin#

linux-kernel router-proxy-firewall tcp-udp

2 Contributors
2 Replies
193 Views
1 Week Discussion Span
Latest Post 19 Years Ago Latest Post by Mix

Dani AI

Generated 6 Months Ago

Good catch, — the extra “LD”/bogon-style records you tracked down are a classic cause of this symptom: a firewall that looks like it’s refusing everything except the local network even though explicit service accepts exist. Those entries will silently eat packets if they’re (a) syntactically matching the wrong field (source vs destination), (b) expanded incorrectly by the script, or (c) placed before the service ACCEPTs in the chain.

Quick, practical checks to find and verify the offending rules:

List rules with counters and line numbers so you can see which rules are actually matching traffic:

iptables -L INPUT -n -v --line-numbers
iptables -S | sed -n '1,120p'    # inspect exact matches (-s/-d) and options

If a particular LD/drop rule shows non‑zero packet counts for traffic you expect to be allowed, that’s your culprit. To test without rebuilding the whole script, insert stateful accepts at the top (do this from the server console or have a fallback if you’re remote):
```
iptables -I INPUT 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -I INPUT 2 -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
iptables -I INPUT 3 -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
```
If external DNS/SSH/FTP start working immediately, the LD entries were shadowing them.

Longer term fixes and cautions:

Fix the generator script so bogon drops explicitly match the packet source (use -s <bogon>), not the destination, and only append those drops after service accepts.
Keep a small ordered policy: allow loopback, allow ESTABLISHED, allow per-service NEW, then optional bogon drops, then final DROP.
Remember FTP needs conntrack helpers (and passive port ranges), and DNS needs both UDP and TCP 53 allowed.
Use iptables-save/iptables-restore or a tested script to keep rule order deterministic, and add targeted LOG rules to catch future surprises.

Good debugging — your elimination approach was exactly the right way to isolate it. , Firestarter can produce long autogenerated lists like this; inspect the generated rules before trusting the defaults.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Angusm 0 Newbie Poster · Answer 1 · 2007-07-10T22:16:13+00:00

I hacked the firewall script and by a process of elimination found that it was the very records I thought were irrelevant that were causing the problem - each one blocked all traffic from an entire network not just the non-routable addresses as implied by the firewall script comments.

Mix -2 Junior Poster in Training · Answer 2 · 2007-07-16T21:57:04+00:00

At least you have Firestarter working. I cant get it installed on Slackware..