Problems with connection
amilivojevic at pbl.ca
Mon Sep 13 23:16:35 CEST 2004
Giancarlo Boaron wrote:
> I have a client in my LAN that must access a server on
> the Internet listening for requests on 3456 port.
> Using the FORWARD chain (default police = DROP) I have
> the following lines:
> iptables -A FORWARD -m state ESTABLISHED,RELATED -j
> <... my rules ...>
> iptables -A FORWARD -d X.Y.0.0/16 -p tcp --dport 3456
> -j ACCEPT
> Does it mean that the server is trying to start a new
> back connection to the client and my DROP policy is
> applied? (since I don't permit new incoming
> I read the application documents and it only says that
> I must allow outgoing traffic to and from
> X.Y.0.0/16:3456 using TCP protocol.
The easiest way to see if your firewall is dropping anything is to add
something like this to the end of your firewall rules (provided you
don't have any DROP targets beforehand):
iptables -A FORWARD -s X.Y.0.0/16 -j LOG --log-prefix "FWD_FRM_X_Y "
iptables -A FORWARD -d X.Y.0.0/16 -j LOG --log-prefix "FWD_TO_X_Y "
If there is any callback connection, it will show in kernel log (on Red
Hatish systems /var/log/messages). It will also show if your firewall
is blocking any other packets between your network and X.Y.0.0/16.
Aleksandar Milivojevic <amilivojevic at pbl.ca> Pollard Banknote Limited
Systems Administrator 1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
More information about the netfilter