2

So I've done a fresh install of Ubuntu Server 18.04 LTS on my spare 2-Core, 4GB DDR2 PC I'm not really using. I'm trying to open ports for nginx, Grafana, Prometheus etc. I've installed, enabled and configured ufw, iptables seems to be correct but I'm pretty new to networking in Linux, I've been a sysadmin for really long so didn't really mess with networking much. I've pasted my iptables, ufw and netstat -tulpen in code blocks below, I'm not sure what else I'm doing wrong, I've also forwarded the ports through my Router (MikroTik, included screenshots below too) but nothing I do works... 

root@server:/home/user# ufw status verbose Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To Action From -- ------ ---- 22/tcp ALLOW IN Anywhere 80/tcp ALLOW IN Anywhere 443/tcp ALLOW IN Anywhere 3000/tcp ALLOW IN Anywhere 3000/udp ALLOW IN Anywhere 22/tcp (v6) ALLOW IN Anywhere (v6) 80/tcp (v6) ALLOW IN Anywhere (v6) 443/tcp (v6) ALLOW IN Anywhere (v6) 3000/tcp (v6) ALLOW IN Anywhere (v6) 3000/udp (v6) ALLOW IN Anywhere (v6) root@server:/home/user# iptables --list-rules -P INPUT DROP -P FORWARD DROP -P OUTPUT ACCEPT -N ufw-after-forward -N ufw-after-input -N ufw-after-logging-forward -N ufw-after-logging-input -N ufw-after-logging-output -N ufw-after-output -N ufw-before-forward -N ufw-before-input -N ufw-before-logging-forward -N ufw-before-logging-input -N ufw-before-logging-output -N ufw-before-output -N ufw-logging-allow -N ufw-logging-deny -N ufw-not-local -N ufw-reject-forward -N ufw-reject-input -N ufw-reject-output -N ufw-skip-to-policy-forward -N ufw-skip-to-policy-input -N ufw-skip-to-policy-output -N ufw-track-forward -N ufw-track-input -N ufw-track-output -N ufw-user-forward -N ufw-user-input -N ufw-user-limit -N ufw-user-limit-accept -N ufw-user-logging-forward -N ufw-user-logging-input -N ufw-user-logging-output -N ufw-user-output -A INPUT -j ufw-before-logging-input -A INPUT -j ufw-before-input -A INPUT -j ufw-after-input -A INPUT -j ufw-after-logging-input -A INPUT -j ufw-reject-input -A INPUT -j ufw-track-input -A FORWARD -j ufw-before-logging-forward -A FORWARD -j ufw-before-forward -A FORWARD -j ufw-after-forward -A FORWARD -j ufw-after-logging-forward -A FORWARD -j ufw-reject-forward -A FORWARD -j ufw-track-forward -A OUTPUT -j ufw-before-logging-output -A OUTPUT -j ufw-before-output -A OUTPUT -j ufw-after-output -A OUTPUT -j ufw-after-logging-output -A OUTPUT -j ufw-reject-output -A OUTPUT -j ufw-track-output -A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input -A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input -A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input -A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input -A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input -A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input -A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input -A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] " -A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] " -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT -A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT -A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT -A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT -A ufw-before-forward -j ufw-user-forward -A ufw-before-input -i lo -j ACCEPT -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny -A ufw-before-input -m conntrack --ctstate INVALID -j DROP -A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT -A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT -A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT -A ufw-before-input -j ufw-not-local -A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT -A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT -A ufw-before-input -j ufw-user-input -A ufw-before-output -o lo -j ACCEPT -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A ufw-before-output -j ufw-user-output -A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] " -A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN -A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] " -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny -A ufw-not-local -j DROP -A ufw-skip-to-policy-forward -j DROP -A ufw-skip-to-policy-input -j DROP -A ufw-skip-to-policy-output -j ACCEPT -A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT -A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 80 -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 443 -j ACCEPT -A ufw-user-input -p tcp -m tcp --dport 3000 -j ACCEPT -A ufw-user-input -p udp -m udp --dport 3000 -j ACCEPT -A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] " -A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable -A ufw-user-limit-accept -j ACCEPT root@server:/home/user# netstat -tulpen Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 101 14938 365/systemd-resolve tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 17390 541/sshd tcp 0 0 127.0.0.1:42561 0.0.0.0:* LISTEN 0 18558 512/containerd tcp6 0 0 :::22 :::* LISTEN 0 17392 541/sshd udp 0 0 127.0.0.53:53 0.0.0.0:* 101 14937 365/systemd-resolve udp 0 0 192.168.88.225:68 0.0.0.0:* 100 14982 288/systemd-network root@server:/home/user# Here's a test from my laptop running MacOS: $ nc -vzt 192.168.88.225 3000 nc: connectx to 192.168.88.225 port 3000 (tcp) failed: Connection refused Here's my MikroTik Config currently: [![MikroTik Config 1][1]][1] [1]: https://i.sstatic.net/yDHlB.png [![MikroTik Config][2]][2] [2]: https://i.sstatic.net/FSFXU.png I appreciate any help in advance :)
Improve this question

1 Answer 1

Reset to default
1

You only seem to have SSH (port 22) listening. No other server daemons appear to be running.

Specifically, you have nothing on port 3000, so connecting to that correctly returns "connection refused" (if you had it firewalled it would have said, "connection timed out" -- connection refused means you got to receive an answer packet, which tells that the port is open in the firewall).

Use "ps" to verify whether nginx is running (I'd say it is not). What happens if you run, 

systemctl start nginx systemctl status nginx

update

If you are running a Docked nginx, you should be aware that by default, Docker does not do port forwarding. You need to explicitly tell Docker to "publish" those services. This is because, among other things, if you had two or more Docker instances on the same host, you could never be sure to which container you were connecting. So you need to map Docked ports to different host ports, which in turn means you have to do this explicitly:

# Docker #1 options -p 8001:80 # publish nginx's port 80 (default) to port 8001 # Docker #2 -p 8002:80 # publish nginx's port 80 (default) to port 8002 ...and so on...

From your Mac you would then navigate to http://192.168.88.225:8001, and be connected with port 80 of the nginx running in docker container 1.

Improve this answer
3
  • Okay fair enough I see what you mean, I should have clarified initially in my question that I'm also experimenting with running nginx in Docker +/ Kubernetes but I completely forgot to include it. I installed nginx natively with the standard sudo apt install nginx and the port is open and working, shows the nginx default page so that basically helps me fix one thing. I think the only solution I have here is to run everything I need natively or figure out the spaghetti mess of networking for K8s/Docker to get them to run nginx etc over my network. I appreciate your help! Commented Apr 4, 2020 at 7:20
  • 1
    @Defirence the second... the second one you've said. But it's not so great a spaghetti mess, I am sure we can work it out! Commented Apr 4, 2020 at 9:51
  • 1
    Yay it works! Thank you so much! I work with Kubernetes mostly so I haven't delved into docker that much but it's working flawlessly now. I shall now move on to Grafana etc now that I know what to do. :) Commented Apr 4, 2020 at 15:23

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.