grongor's questions

I have problem with my iptables setup. I want to have completely dual stacked server so I use same rules for IPv4 and IPv6. However all IPv6 connections are just being dropped while IPv4 are working without any problem.

Here are all files I use to populate firewall rules: here - First file is the script I run, second contains common (shared) rules for IPv4 and IPv6 and third and forth are files containing specific rules for IPv4 and IPv6.

I want to point out that everything works perfectly on IPv4.

Problem isn't just with the services like FTP but I can't even ping the server (tested from many computers on many different networks).

Just for you to be sure, this is output of command iptables -L -n -v:

Chain INPUT (policy DROP 511 packets, 79527 bytes)
 pkts bytes target     prot opt in     out     source               destination
 1765  739K ACCEPT     all  --  !eth0  *       0.0.0.0/0            0.0.0.0/0
43146 1980K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcpflags: 0x10/0x10
  180 26305 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
  138  8300 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp multiport dports 20,21,25,80,443,465
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:50000:50500
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1194
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 0
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 4
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 11171 packets, 65M bytes)
 pkts bytes target     prot opt in     out     source               destination

and this is the output of command ip6tables -L -n -v:

Chain INPUT (policy DROP 32 packets, 3076 bytes)
 pkts bytes target     prot opt in     out     source               destination
    8   832 ACCEPT     all      !eth0  *       ::/0                 ::/0
    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0                 tcpflags: 0x10/0x10
    0     0 ACCEPT     all      *      *       ::/0                 ::/0                 state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0                 tcp multiport dports 20,21,25,80,443,465
    0     0 ACCEPT     tcp      *      *       ::/0                 ::/0                 tcp dpts:50000:50500
    0     0 ACCEPT     udp      *      *       ::/0                 ::/0                 udp dpt:1194
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0                 ipv6-icmptype 129
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0                 ipv6-icmptype 1
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0                 ipv6-icmptype 128
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0                 ipv6-icmptype 3
    0     0 ACCEPT     icmpv6    *      *       ::/0                 ::/0                 ipv6-icmptype 4

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Ouput of iptables-save:

*filter
:INPUT DROP [93:13846]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4788:4752203]
-A INPUT ! -i eth0 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp -m multiport --dports 20,21,25,80,443,465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 50000:50500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
COMMIT

Output of ip6tables-save:

*filter
:INPUT DROP [6:778]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT ! -i eth0 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp -m multiport --dports 20,21,25,80,443,465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 50000:50500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 129 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 1 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 3 -j ACCEPT
-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 4 -j ACCEPT
COMMIT

If I try to ping the server over IPv6 (ping -6 2a02:2b88:2:1::2498:1) then I get Request timed out. If I try to ping it on the server (over SSH), then It ping's without any problem:

ping6 2a02:2b88:2:1::2498:1 --> 64 bytes from 2a02:2b88:2:1::2498:1: icmp_seq=1 ttl=64 time=0.034 ms

OR

ping6 localhost --> 64 bytes from localhost: icmp_seq=1 ttl=64 time=0.031 ms

I also forgot to mention that if I change whole INPUT chain to ACCEPT then everything works. Of course this is unfortunately not an option ...

I have problem with connecting to my SSH server through OpenVPN from my iPhone.

I can successfully connect from my PC so all settings are good. OpenVPN also works well ("connected") - I can see VPN icon in the top right corner.

The problem is with SSH - I cannot even ping to the local address. When I tried to trace 10.0.1.1 (server IP on VPN) it goes through some to me now known IP addresses and then just times out. It looks like to me that applications are ignoring the VPN and they are trying to reach the address 10.0.1.1 through "normal" network.

Application which I'm using: OpenVPN, Scany (ping & trace) and iSSH.

Does someone have similiar problem? Do you have any idea what I can try to do to make it work?Thank you for your time.

EDIT - here is the log generated by OpenVPN on iPhone:

2013-05-03 15:59:33 ----- OpenVPN Start -----
2013-05-03 15:59:33 LZO-ASYM init swap=0 asym=0
2013-05-03 15:59:33 EVENT: RESOLVE
2013-05-03 15:59:33 EVENT: WAIT
2013-05-03 15:59:33 Connecting to artworksmedia.cz:1194
(37.157.197.197) via TCPv4
2013-05-03 15:59:33 EVENT: CONNECTING
2013-05-03 15:59:33 Tunnel Options:V4,dev-type tun,link-mtu
1544,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher
BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client
2013-05-03 15:59:33 Peer Info:
IV_VER=1.0
IV_PLAT=ios
IV_NCP=1
IV_LZO=1

2013-05-03 15:59:34 VERIFY OK: depth=0
cert. version : 3
serial number : 01
issuer name  : C=CZ, ST=Czech Republic, L=Varnsdorf, O=Artworks Media,
CN=Artworks Media, 0x29=Artworks Media,
[email protected]
subject name  : C=CZ, ST=Czech republic, L=Varnsdorf, O=Artworks
Media, CN=Artworks Media, 0x29=Artworks Media,
[email protected]
issued  on    : 2012-09-16 10:02:24
expires on    : 2022-09-14 10:02:24
signed using  : RSA+SHA1
RSA key size  : 1024 bits

2013-05-03 15:59:34 VERIFY OK: depth=1
cert. version : 3
serial number : D5:00:96:A7:C3:3A:79:3D
issuer name  : C=CZ, ST=Czech Republic, L=Varnsdorf, O=Artworks Media,
CN=Artworks Media, 0x29=Artworks Media,
[email protected]
subject name  : C=CZ, ST=Czech Republic, L=Varnsdorf, O=Artworks
Media, CN=Artworks Media, 0x29=Artworks Media,
[email protected]
issued  on    : 2012-09-16 10:00:40
expires on    : 2022-09-14 10:00:40
signed using  : RSA+SHA1
RSA key size  : 1024 bits

2013-05-03 15:59:34 SSL Handshake: TLSv1.0/SSL-EDH-RSA-AES-256-SHA
2013-05-03 15:59:34 Session is ACTIVE
2013-05-03 15:59:35 EVENT: GET_CONFIG
2013-05-03 15:59:35 Sending PUSH_REQUEST to server...
2013-05-03 15:59:35 OPTIONS:
0 [ping] [10]
1 [ping-restart] [120]
2 [ifconfig] [10.0.1.2] [10.0.1.1]

2013-05-03 15:59:35 LZO-ASYM init swap=0 asym=0
2013-05-03 15:59:35 EVENT: ASSIGN_IP
2013-05-03 15:59:35 Connected via tun
2013-05-03 15:59:35 EVENT: CONNECTED @artworksmedia.cz:1194
(37.157.197.197) via /TCPv4 on tun/10.0.1.2/

I have problem with my ProFTPD server.

When I try to connect to the server using TLS then I get timeout after MLSD command. It only happens whenI use TLS - without it it works perfectly.

I checked these logs:

proftpd.log - USER xxx: Login successful.

tls.log - TLSv1/SSLv3 connection accepted ... Protection set to Private

Where could be problem please? I can provide more informations, just ask for them in comments.

EDIT: Today I tried to set INPUT policy of iptables to ALLOW ... everything worked ... so issue is a firewall. How should I set iptables to work with FTPS ?

Here are my iptables settings:

*filter
:INPUT DROP [930:61159]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [256:26448]
-A INPUT ! -i eth0 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A INPUT -p tcp -m tcp -m multiport --dports 80,443,20,21,25,143,993,110,995,1194 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
COMMIT