Home / server / Questions / 1080057
In Process
einpoklum
Asked: 2021-10-10 00:50:15 +0800 CST

How do I figure out what prevents incoming connections on a certain port?

  • 772

I would like to enable SSH connections on an additional port on my machine, for reasons. It is a physical machine (not a VM), running Devuan GNU/Linux Chimaera (~= Debian 11.0 without systemd). The default SSH server (OpenSSH_8.4p1 Debian-5, OpenSSL 1.1.1k) is running fine and accepting connections on port 22 already.

I've added two Port entries to my /etc/sshd_config:

Port 22
Port 5123

and have restarted the service.

What I now experience is that from within the same machine, I can connect to both ports (ssh -p 5123 localhost works); but from other machines on the LAN, I can only connect to port 22. This is a physical LAN (cables running to a switch), so there should be no blockage along the way.

  • I couldn't find any mention of a rejected connection in /var/log/auth.log.
  • I checked /etc/hosts.allow and /etc/hosts.deny - they're both empty (except for comment lines).
  • I tried iptables --list - all tables are empty.

So, what could be blocking the connection on port 5123 from other machines, and how can I unblock it?

Edit: Additional information:

# lsof -Pi :5410
COMMAND   PID USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
sshd    27566 root    3u  IPv4 19305483      0t0  TCP *:5410 (LISTEN)
sshd    27566 root    4u  IPv6 19305485      0t0  TCP *:5410 (LISTEN)

# iptables-save
# Warning: iptables-legacy tables present, use iptables-legacy-save to see them
# iptables-legacy-save 
# Generated by iptables-save v1.8.7 on Sun Oct 10 09:30:15 2021
*filter
:INPUT DROP [3837243:374065333]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [8124295:583169789]
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -p ah -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Sun Oct 10 09:30:15 2021

So it looks like there's a rule for accepting port 22 as input, but no such rule for port 5123. The question remains, though - what's the cause of this situation?

# cat /etc/nftables.conf
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0;
    }
    chain forward {
        type filter hook forward priority 0;
    }
    chain output {
        type filter hook output priority 0;
    }
}

On Debian 11, and Devuan Chimaera, iptables is actually a symlink:

# readlink  `which iptables`
/etc/alternatives/iptables
# readlink -f `which iptables`
/usr/sbin/xtables-nft-multi
ssh port block

0 Answers