Modification to Firewall don't seem to apply to VM

[artman41]

Hi,

So I've tried to setup the Firewall to reject all requests except ones on certain ports - those being SSH, tcp 8080 + the ports for a Java Minecraft Server

The Minecraft ports are setup as a Security Group at the Datacenter Level

The VMs Firewall config looks like this


At a VM level, the Firewall is enabled & Input Policy is set to REJECT, Output Policy is set to ACCEPT

At a Node Level, I don't have any Firewall rules setup but do have the firewall enabled

At a Datacenter Level, I don't have any Firewall rules setup but do have the firewall enabled


Trying to use Netcat to test the port forwarding (specifically tcp port 8080), I get Connection refused


Setting the Firewall Input Policy of the VM to ACCEPT though, I can connect just fine


Could somebody point out where exactly I'm going wrong here? Unless I set the Input Policy to ACCEPT, I can't connect in with anything but SSH

The VM host is Fedora 34 using IPTables (Firewalld is disabled) and I've cleared the iptables configuration so that it accepts everything

 

[Lorenz.S]

Cloud it be, that your rules are not quite right? Try letting the source port unconfigured. Otherwise a client connection to port 8080 would have to use port 8080 as its source port.

 

[ph0x]

The golden rule of firewall config: only set a source port if you absolutely know what you're doing.

 

[artman41]

Cloud it be, that your rules are not quite right? Try letting the source port unconfigured. Otherwise a client connection to port 8080 would have to use port 8080 as its source port.

The golden rule of firewall config: only set a source port if you absolutely know what you're doing.

Thank you so much, you two are legends - I assumed that the Source Port would be the port I connected in with & the Destination Port would be the port that VM was hit on

 

[ph0x]

It is, but usually the connecting system doesn't use the well-known port of a service as source but a so-called ephemeral port, mostly 5-digit numbers.
Therefore source ports are very rare to be set.