On 8/16/2011 10:51 PM, Andre Speelmans wrote:
I have been going through all the responses I got so far and am now in
process of going through this. I can't test the 127.0.0.1 as I've got my
systems somewhat horked trying to sort things out ... after this email I
am backing everything up to "factory install" to try out this and the
other suggestions for tests.
What I do know at this point is that it is not a matter of name
resolution as I tried telnet <name> 22 to use ssh which I know works and
the name resolved with a connection made (though utterly useless to use).
Aside from the concerns about "why is my network the way it is" which I
intend to address, I am pretty certain the problem is in iptables. I can
telnet to cs.cmu.edu, so I know telnet is working on all my machines.
My iptables is the default per F14 installation:
+++
# Generated by iptables-save v1.4.9 on Tue Aug 16 22:13:30 2011
# Used command "iptables-save > iptables_F14_ORIGINAL_yoyo"
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [9950:627381]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Aug 16 22:13:30 2011
+++
I don't understand the OUTPUT as it is different for each of the three
machines I am working with, but from what I can tell from the iptables
literature, my issue is with INPUT
I added a LOG on input immediately before rejecting and can see that, on
the destination machine, there is an entry corresponding to the request
"telnet <name>" (note I have dropped the port number to allow telnet to
use its default port):
+++
Aug 16 22:39:58 chalupa kernel: [ 2784.447580] IN=eth0 OUT=
MAC=00:e0:81:00:4c:b0:00:e0:81:00:62:94:08:00 SRC=192.168.2.11
DST=192.168.2.10 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=49145 DF PROTO=TCP
SPT=36385 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0
+++
I don't see anything in /var/log/message on the machine that I did the
telnet request on (which would be the 192.168.2.11 in the above message)
I have been trying what I think is the correct edit in all permuations I
can think of ... as in:
+++
iptables -I INPUT <where every the log entry is> -{s,d}
192.168.2.{10,11} -p tcp -{destination,source}-port telnet -j ACCEPT
+++
I am not having success and the messages in the log are showing me that
I am making a mess. One of the interesting things is I am now getting
"connection refused" rather than "no route to host" and I need to see
what change I made caused that (which is also interesting as I would
have expected "connection refused" if the resolution was "REJECT"?)
If I know what 192.168.2.x machines I want to be able to telnet to and I
modify all machines to have the necessary in iptables to allow a telnet
to/from, what am I missing?
Thanks in advance (this iptables stuff is a bit daunting ...),
Paul
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
