iptables rules wrong order
I need port 54925,UDP open for my scanners and 22000,TCP for syncthing. If I add the appropriate rules to the firewall setup under Extras, port 22000,TCP can be reached. But not the UDP port 54925.
If I understand correctly, Firewall Setup creates the file /etc/init.d/rc.firewall.
In rc.firewall, the additional rules, Custom Extras, for TCP come before the RETURN rule, but the additional UDP rules come after the corresponding RETURN rule.
I'm not a programmer and I hope I got this right.
/etc/init.d/rc.firewall, partially:
Line 565 bis 596
# Not matched, so return for logging
$IPT -A udp_inbound -p UDP -j RETURN
$IP6T -A udp_inbound -p UDP -j RETURN
# udp_outbound chain
#
# This chain is used with a private network to prevent forwarding for
# UDP requests on specific protocols. Applied to the FORWARD rule from
# the internal network. Ends with an ACCEPT
# No match, so ACCEPT
$IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT
# tcp_inbound chain
#
# This chain is used to allow inbound connections to the
# system/gateway. Use with care. It defaults to none.
# It's applied on INPUT from the external or Internet interface.
############################### Custom Extras #################################
# Custom entry for port 22000
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22000 -j ACCEPT
# Custom entry for port 54925
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 54925 -j ACCEPT
############################## END Custom Extras ##############################
# Not matched, so return so it will be logged
$IPT -A tcp_inbound -p TCP -j RETURN
Output from iptables -v -L partially:
Chain tcp_inbound (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:22000
0 0 RETURN tcp -- any any anywhere anywhere
Chain udp_inbound (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP udp -- any any anywhere anywhere udp dpt:netbios-ns
0 0 DROP udp -- any any anywhere anywhere udp dpt:netbios-dgm
0 0 ACCEPT udp -- any any anywhere anywhere udp spt:bootps dpt:bootpc
10 1442 RETURN udp -- any any anywhere anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:54925
F96_3-radkyCE pristine frugal install
