SliTaz Forum
You are not logged in.
Hello to you all!
I am enjoying Slitaz 4 stable version via wlan0 and pretty much have it working the way I want it and the Transmission package works well for me.
What I would like is help with configuring iptables rules to keep Transmission working when the rules are enabled.
Seems to me it should be simple but I have been searching and trying different configs and it seems no matter what when I enable the rules the port becomes closed.
I am using the default port 51413 and am not sure if it is only a rule to keep this port open or if something more is required?
Can anybody give me a working example ?
Offline
I presume you have checked this?
https://trac.transmissionbt.com/wiki/PortForwardingGuide
and this...
https://trac.transmissionbt.com/wiki/PortClosed
Hope this helps.
Offline
Hi G,
Yes both those and everything else I could find. You can confidently presume that I have exhausted all searchable resources that I could personally find.
My question was how to configure iptables so that I had a functional and hopefully strong firewall enabled and still be able to use Transmission.
I'll try and be more clear about what I am asking, here's where I am at the moment:
- Everything works fine with iptables disabled.
- Transmission does not work with iptables enabled in all the various configs I could find searching this forum and googling the net with all the relevant search terms I could think of.
I can't see any examples of iptable config for Transmission in Slitaz in either of those links you have suggested.
As there is a package for Transmission surely someone must be using it successfully in conjunction with an enabled iptable firewall?
Any help is always well appreciated and a working example would be the best learning aid for me as I am new to iptables and am still confused by them after trying so many configs.
I am using a self administrated wireless network using static addresses for all network elements but I don't see that that should make any difference as it all works when the iptables are disabled.
So to me it seems as if it is the settings in the firewall.conf file that need to be corrected.
Offline
Hi TraceE,
I have not tried what you are trying to do so cannot give you a working example so all I can do is to suggest somethings to try out.
Perhaps, it may help if you can post your /etc/firewall.conf.
Offline
Hi again,
It will also be good to post the output of 'iptables -S'
Offline
Hi G .... yes I am always happy to try out suggestions thanks .... (I've just been working on another live usb so it's back to standard) .... Transmission works fine when:
# Enable/disable iptables rules (iptables package must be installed).
IPTABLES_RULES="no"
So it's got to be something in the settings ...... here is network.conf as is:
# /etc/firewall.conf: SliTaz firewall configuration.
# Config file used by: /etc/init.d/firewall.sh
#
# Network interface.
INTERFACE="eth0"
# Enable/disable kernel security.
KERNEL_SECURITY="yes"
# Enable/disable iptables rules (iptables package must be installed).
IPTABLES_RULES="yes"
# Netfilter/iptables rules.
# This shell function is included in /etc/init.d/firewall.sh
# to start iptables rules.
#
iptables_rules()
{
# Drop all input connections.
iptables -P INPUT DROP
# Drop all output connections.
iptables -P OUTPUT DROP
# Drop all forward connections.
iptables -P FORWARD DROP
# Accept input on localhost (127.0.0.1).
iptables -A INPUT -i lo -j ACCEPT
# Accept input on the local network (192.168.0.0/24).
iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
# Accept near all output trafic.
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# Accept input trafic only for connections initialized by user.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# If you manage a HTTP/SSH/FTP/IRC server you can accept input for non-established connections an some ports.
# else you can disable the lines below for more secured setup
# Accept input on port 80 for the HTTP server.
iptables -A INPUT -i $INTERFACE -p tcp --source-port 80 -j ACCEPT
# Accept input on port 22 for SSH.
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 22 -j ACCEPT
# Accept port 21 and, 1024 to 60310 for FTP.
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 21 -j ACCEPT
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 1024:60310 -j ACCEPT
# Accept port 6667 for IRC chat.
iptables -A INPUT -i $INTERFACE -p tcp --source-port 6667 -j ACCEPT
# Accept unprivileged ports.
iptables -A INPUT -i $INTERFACE -p udp --destination-port 1024:65535 -j ACCEPT
# Accept ping.
iptables -A INPUT -i $INTERFACE -p icmp -j ACCEPT
}
Offline
And iptables -S :
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.0.0/24 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 1024:60310 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 6667 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 1024:65535 -j ACCEPT
-A INPUT -i eth0 -p icmp -j ACCEPT
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
Offline
After further investigation it seems that when trying to download two torrent files with the standard iptables config enabled ...... only one of them would download slowly and neither would upload.
After iptables were disabled everything was working normally again.
Offline
1. Add the following to your firewall.conf
# Accept port 51413 for Transmission
iptables -A INPUT -i $INTERFACE -p udp --destination-port 51413 -j ACCEPT
2. Save firewall.conf
3. run /etc/init.d/firewall stop
4. run /etc/init.d/firewall start
5. now when you run 'iptables -S' you should see an additional line like
-A INPUT -i eth0 -p udp -m udp --dport 51413 -j ACCEPT
Now try Transmission again and see whether it has fixed your problem.
Offline
EDIT: did not see that you have a line enabling all ports 1024 to 65535 so essentially this should allow 51413 in.
Did a Wireshark trace and I noticed that Transmission client starts off with BT-uTP with unknown uTorrent protocol type message. This process goes on for sometime and then Transmission client uses udp 51413 and then finds the active peers and download starts.
But if you can disable iptables and get it to work then as you suggest there must be something in iptables causing the problem. Have tried using Wireshark to see what messages you are getting?
The other issue I just noticed is that your original post says that 'it seems no matter what when I enable the rules the port becomes closed'. Does this mean that you get the message Port Closed when you press 'check port' button on the settings screen? I tried on my Ubuntu machine and I also get the port closed message but there is no problem downloading any torrent files. As I said, the client appears to try using uTP protocol (if this option is checked on the settings) for quite a while and then starts udp 51413 and finds peers and download proceeds normally.
Also, noticed that on the Transmission client, it states it is testing the TCP port 51413 and not the UDP port. So, see whether changing the udp to tcp in your firewall.conf would make any difference.
Offline
Yes I get the message port closed when the iptables are enabled.
I tried downloading files with iptables enbled and the port test showing closed and it did download the file at the top of the list slowly but none of the others and would not upload at all.
After disabling the iptables all the files would download and upload.
So yes it does work with port test showing closed when iptables are enabled but very poorly compared to when iptables are disabled and port test shows open.
I am not familiar with wireshark but will go and have a look at it when I get some free time and will try your other suggestions.
I'm surprised it seems so difficult to find out about Transmissions port requirements .....
Offline
Installed wireshark and ran a capture while a torrent downloaded and seeded.
To tell you the truth I have no idea where to start with wireshark ... the amount of info is huge .... 
Any suggestions?
Offline
You would need to set up the filters to filter out unwanted packets.
You can do this using the filter window. You can type something like ip.addr==xx.xx.xx.xx to filter everything else other than packets coming from xx.xx.xx.xx and of course you can narrow it down to the protocol or port level.
Check out http://www.wireshark.org/docs/wsug_html_chunked/index.html for filter settings.
Admittedly it is a bit of work but it is fully worth as you can use this knowledge to sort out many other problems.
Just a note of caution with filters - if you set it too narrow then you will miss out on broadcast messages etc which may give you a clue as to what is going on.
Offline
...... Looks like a LOT of work!
I'll have a go when I've got time.
I'm really surprised nobody else here seems to use transmission with the iptables enabled.
I'm relatively new to Linux coming from windows .... am I just being overcautious .... is the firewall not such an important priority with Slitaz?
Offline
This is your problem:
Yes I get the message port closed when the iptables are enabled.
Does transmission Port test indicate port 51413 is open with iptables disabled?
I tested transmission with iptables enabled with default slitaz rule set of /etc/slitaz/firewall.sh on slitaz-4.0 and cooking 32bit.
When transmissions Port test button is clicked it indicates port 51413 is open.
If transmission Port test indicates port 51413 is open with iptables disabled but closed with iptables enabled with default rule set then something is broken on your install.
If [c]tazpkg repack linux-netfilter[/c] fails download/install a fresh copy of linux-netfilter.
Offline
Interesting ..... yes I will try that later on tonight and post what happens.
I am using the standard Slitaz 4.0 stable installed on a USB stick with default rule set.
At the moment:
With default iptables rules enabled, transmission port test indicates port 51413 closed ... it will still download slowly but will not upload at all.
With default iptables rules disabled, transmission port test indicates port 51413 open and works perfectly with downloads and uploads.
I will try your suggestions and post back later ...
Offline
Ok what I did was:
Opened Package Manager, recharged list , my packages, removed and then reinstalled linux-netfilter.
Opened pcmanfm as root, enabled default iptables in /etc/firewall.conf and saved the file.
Opened terminal as root, /etc/init.d/network.sh stop
/etc/init.d/network.sh start
Closed terminal
Opened transmission, preferences, then tested port and it tested open. 
So seemed to have worked.
BUT .... after using TasUSB Writefs to save settings to USB stick and rebooting ........ the port 51413 again tests as closed and I can't seem to replicate the earlier result where it tested open ??????
Offline
Hi TraceE,
I was having similar issues with getting iptables to work with Transmission. I solved my torrent problem with the following iptables rule set:
*filter
#Creating default policies
:INPUT DROP [0:0]
:OUTPUT DROP [0:0]
:FORWARD DROP [0:0]
#Allow traffic on loopback
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
#Allow previously established connections to continue uninterupted
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#Allow outbound connections on the ports and services we need
#HTTP
-A OUTPUT -p tcp --dport 80 -j ACCEPT
#HTTPS
-A OUTPUT -p tcp --dport 443 -j ACCEPT
#DHCP
-A OUTPUT -p udp --dport 67:68 -j ACCEPT
#DNS
-A OUTPUT -p udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp --dport 53 -j ACCEPT
#Bittorrent (Transmission uses port 51413 and port 6969)
-A OUTPUT -p udp --dport 51413 -j ACCEPT
-A OUTPUT -p tcp --dport 51413 -j ACCEPT
-A OUTPUT -p tcp --dport 6969 -j ACCEPT
COMMIT
I'm using Arch so my syntax will probably be a bit different but other than that I hope this helps.
Regards,
Jim
Offline
I am a relative newby to Linux:
Is this a full set of alternative rules or is it to be added to whats already there?
Sorry if that's a stupid question, I'm getting better with Slitaz everyday but there's still so much to get used to after moving over from years with windows ....
Thanks for your help!
Offline
Hi TraceE,
I noticed from one of your previous posts that you have the following entries in your network.conf file:
---------------------------
# Drop all input connections.
iptables -P INPUT DROP
# Drop all output connections.
iptables -P OUTPUT DROP
# Drop all forward connections.
iptables -P FORWARD DROP
---------------------------
Now, the line we're interested in specifically is -
# Drop all output connections.
iptables -P OUTPUT DROP
If it was me, and as an experiment, I'd backup my original network.conf file to a safe place before changing the above line in the original file to read as follows -
# Allow all outgoing connections.
iptables -P OUTPUT ACCEPT
...I'd then reboot my system, making sure that iptables is up and running (sudo iptables -nvL) after the reboot, before trying to download something with Transmission.
I'd be interested to know how you get on...
Regards,
Jim
Offline
Ok T. I have tried that and the port still tests as closed .....
Here is the edited firewall.conf with your changes implemented so you can see what I'm testing:
# /etc/firewall.conf: SliTaz firewall configuration.
# Config file used by: /etc/init.d/firewall.sh
#
# Network interface.
INTERFACE="eth0"
# Enable/disable kernel security.
KERNEL_SECURITY="yes"
# Enable/disable iptables rules (iptables package must be installed).
IPTABLES_RULES="yes"
# Netfilter/iptables rules.
# This shell function is included in /etc/init.d/firewall.sh
# to start iptables rules.
#
iptables_rules()
{
# Drop all input connections.
iptables -P INPUT DROP
# Allow all output connections.
iptables -P OUTPUT ACCEPT
# Drop all forward connections.
iptables -P FORWARD DROP
# Accept input on localhost (127.0.0.1).
iptables -A INPUT -i lo -j ACCEPT
# Accept input on the local network (192.168.0.0/24).
iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
# Accept near all output trafic.
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# Accept input trafic only for connections initialized by user.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# If you manage a HTTP/SSH/FTP/IRC server you can accept input for non-established connections an some ports.
# else you can disable the lines below for more secured setup
# Accept input on port 80 for the HTTP server.
iptables -A INPUT -i $INTERFACE -p tcp --source-port 80 -j ACCEPT
# Accept input on port 22 for SSH.
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 22 -j ACCEPT
# Accept port 21 and, 1024 to 60310 for FTP.
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 21 -j ACCEPT
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 1024:60310 -j ACCEPT
# Accept port 6667 for IRC chat.
iptables -A INPUT -i $INTERFACE -p tcp --source-port 6667 -j ACCEPT
# Accept unprivileged ports.
iptables -A INPUT -i $INTERFACE -p udp --destination-port 1024:65535 -j ACCEPT
# Accept ping.
iptables -A INPUT -i $INTERFACE -p icmp -j ACCEPT
}
Anymore suggestions I can try?
Offline
Going by transmission's post it appears you have not opened up the following tcp ports although you are allowing udp 51413 (Accept unpriviledged ports section)
-A OUTPUT -p tcp --dport 51413 -j ACCEPT
-A OUTPUT -p tcp --dport 6969 -j ACCEPT
I would add,
# Accept port 51413 and 6969 for Transmission.
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 51413 -j ACCEPT
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 6969 -j ACCEPT
and restart firewall.
EDIT: just noticed that you have got 'Accept port 21 and, 1024 to 60310 for FTP'. FTP uses only port 20 and 21 and opening up from 1024 to 60310 will leave a big hole in your firewall. That brings up another interesting point as by doing this essentially you should have taken care of the requirement to open 51413 and 6969 for Transmission anyway!
Offline
It seems I may have found my problem:
On looking at my own last post there I noticed the line,
# Network interface.
INTERFACE="eth0"
I only have wireless here so changed it to:
# Network interface.
INTERFACE="wlan0"
And on reboot the transmission port test now reads open with the default rule set, I shall test it further tomorrow with some torrents.
It looks like the original problem was a very simple mistake on my part by not having the correct interface selected.
Thanks for all the suggestions and help anyway!
So it looks like I still have a problem with a "big hole in the firewall" that I could maybe tighten up.
Here is the firewall.conf as it is now with the transmission port test showing open (it's just the default rules enabled and the correct interface selected now):
# /etc/firewall.conf: SliTaz firewall configuration.
# Config file used by: /etc/init.d/firewall.sh
#
# Network interface.
INTERFACE="wlan0"
# Enable/disable kernel security.
KERNEL_SECURITY="yes"
# Enable/disable iptables rules (iptables package must be installed).
IPTABLES_RULES="yes"
# Netfilter/iptables rules.
# This shell function is included in /etc/init.d/firewall.sh
# to start iptables rules.
#
iptables_rules()
{
# Drop all input connections.
iptables -P INPUT DROP
# Drop all output connections.
iptables -P OUTPUT DROP
# Drop all forward connections.
iptables -P FORWARD DROP
# Accept input on localhost (127.0.0.1).
iptables -A INPUT -i lo -j ACCEPT
# Accept input on the local network (192.168.0.0/24).
iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
# Accept near all output trafic.
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
# Accept input trafic only for connections initialized by user.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# If you manage a HTTP/SSH/FTP/IRC server you can accept input for non-established connections an some ports.
# else you can disable the lines below for more secured setup
# Accept input on port 80 for the HTTP server.
iptables -A INPUT -i $INTERFACE -p tcp --source-port 80 -j ACCEPT
# Accept input on port 22 for SSH.
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 22 -j ACCEPT
# Accept port 21 and, 1024 to 60310 for FTP.
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 21 -j ACCEPT
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 1024:60310 -j ACCEPT
# Accept port 6667 for IRC chat.
iptables -A INPUT -i $INTERFACE -p tcp --source-port 6667 -j ACCEPT
# Accept unprivileged ports.
iptables -A INPUT -i $INTERFACE -p udp --destination-port 1024:65535 -j ACCEPT
# Accept ping.
iptables -A INPUT -i $INTERFACE -p icmp -j ACCEPT
}
Any suggestions now for tightening up the firewall while still allowing transmission to work properly?
Offline
Glad you sorted out the issue.
Yes, you would want to restrict ftp to ports 20,21 only. And then add ports which are needed for Transmission separately rather than opening up ports 1024-60310 under ftp.
So judging by T's earlier post you would need a new section opening tcp 51413 and 6969 for Transmission. You already have udp 51413 open as an 'unpriviledged port'.
If you are not running ftp, http, ssh or irc then comment them out and just have the following.'
# If you manage a HTTP/SSH/FTP/IRC server you can accept input for non-established connections an some ports.
# else you can disable the lines below for more secured setup
# Accept input on port 80 for the HTTP server.
# iptables -A INPUT -i $INTERFACE -p tcp --source-port 80 -j ACCEPT
# Accept input on port 22 for SSH.
# iptables -A INPUT -i $INTERFACE -p tcp --destination-port 22 -j ACCEPT
# Accept port 21 and, 1024 to 60310 for FTP.
# iptables -A INPUT -i $INTERFACE -p tcp --destination-port 21 -j ACCEPT
# iptables -A INPUT -i $INTERFACE -p tcp --destination-port 1024:60310 -j ACCEPT
# Accept port 6667 for IRC chat.
# iptables -A INPUT -i $INTERFACE -p tcp --source-port 6667 -j ACCEPT
# Accept tcp port 51413 and 6969 for Transmission
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 6969 -j ACCEPT
iptables -A INPUT -i $INTERFACE -p tcp --destination-port 51413 -j ACCEPT
This will block ftp, http, ssh and irc and will only allow Transmission.
Hope this helps.
Offline
Hi TraceE,
Sorted !!!
As for tightening up your firewall, that, for the most part, will depend on your physical setup and what you'd like to achieve. That being said, if you just want a very basic setup that assumes your NOT running a web, ftp, irc or ssh server and that lets you browse the web, check emails, and download torrents etc. then may I suggest the following as an initial starting point:
# /etc/firewall.conf: SliTaz firewall configuration.
# Config file used by: /etc/init.d/firewall.sh
#
# Network interface.
INTERFACE="wlan0"
# Enable/disable kernel security.
KERNEL_SECURITY="yes"
# Enable/disable iptables rules (iptables package must be installed).
IPTABLES_RULES="yes"
# Netfilter/iptables rules.
# This shell function is included in /etc/init.d/firewall.sh
# to start iptables rules.
#
iptables_rules()
{
# Drop all input connections.
iptables -P INPUT DROP
# Allow all outgoing connections.
iptables -P OUTPUT ACCEPT
# Drop all forward connections.
iptables -P FORWARD DROP
# Accept input on localhost (127.0.0.1).
iptables -A INPUT -i lo -j ACCEPT
# Accept input on the local network (192.168.0.0/24).
iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
# Accept input trafic only for connections initialized by user.
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Accept ping.
iptables -A INPUT -i $INTERFACE -p icmp -j ACCEPT
# Reject unwanted tcp and udp packets.
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -j REJECT --reject-with icmp-proto-unreachable
}
May I also suggest http://www.linuxhomenetworking.com/wiki/
Regards,
Jim
PS. Welcome to linux btw!
Offline
[ Generated in 0.016 seconds, 7 queries executed - Memory usage: 1.61 MiB (Peak: 1.77 MiB) ]