0

I'm running an Embedded Linux (kernal 3.8.21) with some applications on it on MIPS. I use iptables & ip6tables to block some ports, like the following:

iptables -A INPUT -p tcp --dport 139 -j DROP

ip6tables -A INPUT -p tcp --dport 139 -j DROP

But port 139 stll can be detected by Nessus SYN scanner and TCP scanner

Port 139/tcp was found to be open

what should I do to prevent the port being found open?

The whole iptable after executing $iptables -L -v is:

 Chain INPUT (policy ACCEPT 158K packets, 7373K bytes)
 pkts bytes target     prot opt in     out     source               destination         
 162K 7734K TRAFFIC_CONTROL  all  --  any    any     anywhere             anywhere            
 162K 7746K parental_black_chain_in  all  --  any    any     anywhere             anywhere            
 163K 7772K INCOMINGFILTER  all  --  any    any     anywhere             anywhere            
 163K 7772K SPI_FW     all  --  any    any     anywhere             anywhere            
 163K 7772K ACL        all  --  any    any     anywhere             anywhere            
 163K 7772K FIREWALL   all  --  any    any     anywhere             anywhere            
    0     0 DROP       tcp  --  !br+   any     anywhere             anywhere            tcp dpt:http 
 163K 7771K HTTP_CTRL  all  --  any    any     anywhere             anywhere            
 163K 7771K PORTS_LIMIT  all  --  any    any     anywhere             anywhere            
    0     0 DROP       tcp  --  !br+   any     anywhere             anywhere            tcp dpt:http 
    0     0 DROP       tcp  --  !br+   any     anywhere             anywhere            tcp dpt:telnet 
    0     0 DROP       tcp  --  !br+   any     anywhere             anywhere            tcp dpt:ftp 
  658 36164 ACCEPT     tcp  --  any    any     anywhere             anywhere            multiport dports netbios-ssn,ldap,microsoft-ds,swat 
  483 71531 ACCEPT     udp  --  any    any     anywhere             anywhere            multiport dports netbios-ns,netbios-dgm 
 161K 7644K storage_chain  all  --  any    any     anywhere             anywhere            
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:netbios-ssn 
    8   384 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:telnet 
    0     0 DROP       udp  --  any    any     anywhere             anywhere            udp dpt:netbios-ns 
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:microsoft-ds 
    8   384 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:domain 
 2788  176K DROP       udp  --  any    any     anywhere             anywhere            udp dpt:domain 
    4   192 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:17998 
    1    30 DROP       udp  --  any    any     anywhere             anywhere            udp dpt:17998 
    4   192 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:17999 
    1    30 DROP       udp  --  any    any     anywhere             anywhere            udp dpt:17999 
   36  1848 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:5555 
    1    30 DROP       udp  --  any    any     anywhere             anywhere            udp dpt:5555 
   63  3244 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:http 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 TRAFFIC_CONTROL  all  --  any    any     anywhere             anywhere            
    0     0 parental_black_chain_fwd  all  --  any    any     anywhere             anywhere            
  897  175K macfilter_chain  all  --  any    any     anywhere             anywhere            
  897  175K ipupfilter_chain  all  --  any    any     anywhere             anywhere            
  897  175K ipdownfilter_chain  all  --  any    any     anywhere             anywhere            
    0     0 url_filter_chain  tcp  --  any    any     anywhere             anywhere            multiport dports http 
    5   260 app_filter_chain  tcp  --  any    any     anywhere             anywhere            
  862  173K app_filter_chain  udp  --  any    any     anywhere             anywhere            
    5   260 TCPMSS     tcp  --  any    nas0_0  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU 
   84 13489 TF_BLOCK_CHAIN  all  --  any    any     anywhere             anywhere            

Chain OUTPUT (policy ACCEPT 155K packets, 6785K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain ACL (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain FIREWALL (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain HTTP_CTRL (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain INCOMINGFILTER (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain PORTS_LIMIT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       tcp  --  ppp+   any     anywhere             anywhere            multiport dports domain,3555,5555,49152,49153 
    0     0 DROP       tcp  --  nas+   any     anywhere             anywhere            multiport dports domain,3555,5555,49152,49153 
    0     0 DROP       udp  --  ppp+   any     anywhere             anywhere            multiport dports domain,3555,bootps,1900 
    0     0 DROP       udp  --  nas+   any     anywhere             anywhere            multiport dports domain,3555,bootps,1900 
    0     0 DROP       tcp  --  ppp+   any     anywhere             anywhere            tcp dpt:17998 
    0     0 DROP       tcp  --  nas+   any     anywhere             anywhere            tcp dpt:17998 
    0     0 DROP       tcp  --  ppp+   any     anywhere             anywhere            tcp dpt:webcache 
    0     0 DROP       tcp  --  nas+   any     anywhere             anywhere            tcp dpt:webcache 

Chain SPI_FW (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain TF_BLOCK_CHAIN (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain TRAFFIC_CONTROL (2 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain app_filter_chain (2 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain internet_chain (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ipdownfilter_chain (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain ipupfilter_chain (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain macfilter_chain (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain parental_black_chain_fwd (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain parental_black_chain_in (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain storage_chain (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain url_filter_chain (1 references)
 pkts bytes target     prot opt in     out     source               destination
3
  • 1
    -A adds rules, previous rules could have left the port open. Please show the entire output of ipstables-save. Commented Nov 28, 2022 at 6:08
  • please provide iptables-save instead. iptables -L -v adds unnecessary formatting and changes input data. Commented Nov 28, 2022 at 6:29
  • I run $iptables -F to delete all existing rules, and then add my new rules at the end of the table using the same command as the above. Now nessus can't detect port open.
    – li_jessen
    Commented Nov 28, 2022 at 8:43

1 Answer 1

2
 iptables -A INPUT -p tcp --dport 139 -j DROP

Since the new rule was appended after existing rules, the already existing rules will be executed first.

  658 36164 ACCEPT     ...     multiport dports netbios-ssn,ldap,microsoft-ds,swat 
  ...
    0     0 DROP       ...     tcp dpt:netbios-ssn 

The ruleset shows an explicit ACCEPT for port 139 (netbios-ssn) before the newly added DROP. Therefore the DROP will never be executed which can also be seen on the statistics on the rule (counter 0).

To insert rules before others use -I, not -A.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .