Ntl blocking incoming ports?

gkhewitt · 15-06-2004, 13:49

Hi there,

Got a small problem, hopefully someone can dig me out! At home I have my NTL SACM hooked up to a Linux (RH9) box that shares the internet,files and printers to other machines on my network here.

Since the server is on the whole time and I was fed up with NTL's email service, I registered my own domain and setup my Linux server as the MX.

This has worked fine for the last 12months or so, but now outside hosts cannot reach the server and mail ends up getting diverted to the backup MX. This isn't a problem in itself as fetchmail still works in picking up email from the backup server, but I do like to be able to login from work and check my email, this can't be done since I can't get through! There's also a webserver running on port 80 (although there's nothing there apart from a welcome note) and SSH on 22. None of these can be accessed. Here's a tracert from centralops.net

Code:

Traceroute
Tracing route to redhat.mydomain.co.uk [xx.xx.xx.xx]...

hop rtt rtt rtt   ip address fully qualified domain name 
1 0 0 0   216.46.228.229 port-216-3073253-es128.devices.datareturn.com 
2 0 0 0   64.29.192.145 port-64-1949841-zzt0prespect.devices.datareturn.com 
3 0 0 0   64.29.192.226 daa.g921.ispb.datareturn.com 
4 0 0 0   168.215.241.133 hagg-01-ae0-1001.dlfw.twtelecom.net 
5 0 0 0   66.192.253.116 core-02-ge-0-3-1-508.dlfw.twtelecom.net 
6 0 0 0   168.215.54.78 tran-01-ge-0-3-0-0.dlfw.twtelecom.net 
7 0 0 0   67.72.4.17 so-4-0-0.gar2.dallas1.level3.net 
8 0 0 9   64.159.3.193 ge-1-3-0.bbr2.dallas1.level3.net 
9 32 32 32   64.159.0.230 ae-0-0.bbr2.washington1.level3.net 
10 105 105 105   4.68.128.101 as-0-0.mp1.london2.level3.net 
11 105 105 139   212.187.129.250 so-4-0.hsa1.london2.level3.net 
12 105 105 105   195.50.116.134  
13 105 105 112   213.105.172.86 bre-bb-a-ae0-0.inet.ntl.com 
14 107 107 107   213.105.172.150 gfd-bb-b-so-700-0.inet.ntl.com 
15 107 107 107   62.253.185.30 glfd-t2core-b-pos31.inet.ntl.com 
16 107 107 107   62.254.207.166 glfd-t2cam1-b-ge-wan31.inet.ntl.com 
17 108 107 108   80.4.30.150 glfd-woki-ubr-1-ge20.inet.ntl.com 
18 * * *     
19 * * *     
20 * * *     
21 * * *     

Trace aborted

Service scan
FTP - 21 Error: TimedOut 
SMTP - 25 Error: TimedOut 
HTTP - 80 Error: TimedOut 
POP3 - 110 Error: TimedOut 
NNTP - 119 Error: TimedOut

Now. Does this mean that there's something wrong on my server, or at the Woking UBR? I've checked my server settings pretty extensively and I don't believe that it's a problem with iptables, but I can post the settings here if it's not a UBR problem. Anyone else in the area have any similar problems?

Cheers guys,

-George

BBKing · 15-06-2004, 14:55

If none of your ports are accessible, I'd suspect an over-eager firewall config. However, are you certain you're tracing/connecting to the correct IP address? After all, your IP is dynamic and could have changed, unless you have systems in place to update your DNS records sharpish. Check the RH9 box to see if the external IP matches the one you're trying to reach.

gkhewitt · 15-06-2004, 15:09

I'd already checked the IP and forgot to add it in to the above post. Did a dig on the A records for my domain and they matched the ones in ifconfig on the linux box.

Just for the record, here are my iptables rules I'm running

Code:

# iptables -L
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp multiport sports ssh,smtp,http,81,pop3,mysql,6616,10000
ACCEPT     all  --  anywhere             anywhere              {eth1}
ACCEPT     all  --  anywhere             anywhere              {lo}
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             {from eth1}

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DROP       tcp  --  anywhere             anywhere            tcp multiport dports 135,netbios-ns,netbios-dgm,netbios-ssn,microsoft-ds,printer,593
DROP       udp  --  anywhere             anywhere            multiport dports 135,netbios-ns,netbios-dgm,netbios-ssn,microsoft-ds,593 udp