Trying to firewall ports 1863, 5190

Question

I'm using Debian's arno-iptables-firewall and I've configured it to only allow access on the ports I need.

But nmap shows ports 1863, 5190 open. What gives? How can I interrogate those ports further?

As I said, I'm actually using arno-iptables-firewall, but as that is difficult to 'debug' (it is very complex), I'm providing an example of the problem with a very simple demo 'firewall' (without arno), which should do the job, but apparently isn't:

$ iptables -A INPUT -p tcp --destination-port 1863 -j DROP 
$ iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:1863 

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

Then nmap example.com -p1863 (from another host) still shows

host is up (0.019s latency).
PORT     STATE SERVICE
1863/tcp open  msnp

Very confused.

UPDATE: OK nmap from different hosts says different things(!). nmap from somewhere else on internet (but within the same VM hosting company's network) shows the ports closed, as they should be, and telnet from these hosts does not work. But from my office ADSL connection, the ports are open and telnet connects (then gets 'closed by foreign host' shortly after).

CONCLUSION: Having now tested from 6 places on the internet, I can only reproduce this behaviour from my office ADSL. I conclude that it is an issue with local routers or our ISP. Thank you to everybody who helped me dig deeper into this issue - I learnt a lot!

Answer 1

In your example it looks like you're trying to config iptables which is different than Arno IPTables. Check out this link for more info on the different types of firewalls.

To see the iptables rules you're running you can type (which you're already doing):

iptables -L

To block the ports you've listed specifically in iptables, since they're both typically TCP traffic, you can use:

-A INPUT -p tcp --dport 1863 -j REJECT
-A INPUT -p tcp --dport 5190 -j REJECT 

Warning: Make sure you're leaving your access open before running something like this, but to reject all non-allowed inbound traffic with iptables you would use:

-A INPUT -j REJECT
-A FORWARD -j REJECT

The trick with iptables is that you'll need to actually save the ruleset since anything that you type via command line is usually flushed on restart.

Arno's IPTables Firewall

For Arno IPTables you can reference the file /etc/arno-iptables-firewall/firewall.conf for additional configuration beyond the scope of the debconf dialogs. To start/stop/restart the firewall from the shell, use the command /etc/init.d/arno-iptables-firewall [start|stop|restart]

According to the firewall.conf file:

Put in the following variables the TCP/UDP ports you want to DENY(DROP) for everyone (and logged). Also use these variables if you want to log connection attempts to these ports from everyone (also trusted/full access hosts). In principle you don't need these variables, as everything is already blocked

(denied) by default, but just exists for consistency.

DENY_TCP="" DENY_UDP=""

If Arno IP Tables is running, in theory those ports should already be blocked. Since they appear as though they're not blocked you may only be running iptables.

You can double-check the ports with netcat or try to telnet to them to see if it's a false positive from nmap.

Netcat example:

nc -z your_server 1-6000

For telnet it if the ports are blocked, they'll say:

> telnet your_server 1863
telnet: Unable to connect to remote host

If the ports are still open, then you'll see:

Connected to your_server

This will be followed by the server response.

You should be able to see what's running by typing top.

Answer 2

A couple of things you can look at for this.

From the host that you're protecting try

sudo netstat -tunap

which should show all network connections. Up the top there should be a set of listening TCP ports and the corresponding process which is making use of them.

from the network try

sudo nmap -sS -sV -sC -v -n [target]

to see if nmap can figure out any more about the port.

Also in general I notice that you've got the iptables input policy set to ACCEPT. I'd recommend setting it to DROP and only allowing the ports you need. It makes securing the box much easier in the long run.

Answer 3

A perhaps crude but rather effective way of finding a potential offending application is to use lsof.

For example: lsof -i | grep LISTEN

Look for services matching the port numbers NMAP claims are open.

Update: Guess I should mention that the command should be run as root to ensure that all open file-handles are listed!

Answer 4

Are you trying to block 1853 and 5190 outbound? If so Nmap isn't ideally suited to determine firewall rules. To truly test a firewall rule with near 100% accuracy you need to send traffic THROUGH the firewall to a known destination on the other side, as opposed to trying to scan the firewall interface/IP itself.

From the Nmap docs:

"While Nmap attempts to produce accurate results, keep in mind that all of its insights are based on packets returned by the target machines (or firewalls in front of them). Such hosts may be untrustworthy and send responses intended to confuse or mislead Nmap." (http://nmap.org/book/man-port-scanning-techniques.html)

You need a solution like IsMyPortBlocked which sends traffic from its client through the firewall and on to the cloud-based server and then back to the client, all over the specified port(s).