Re: ejabberd DNAT problem

On Mon, Apr 17, 2023 at 10:56:17PM -0400, Phil Stracchino wrote:
> Greetings,
> 
> I have a weird problem.  I had a power interruption today during a generator
> install, and when everything came back up afterwards, my XMPP server
> (ejabberd) is not receiving any external connections.  No firewall rules
> changed.

You said they didn't change .. but didn't change since when ?

> The relevant rules in my Shorewall config are:
> 
> Jabberd(ACCEPT)         all                     all
> JabberPlain(ACCEPT)     all                     all
> JabberSecure(ACCEPT)    all                     all
> 
> ...
> 
> # Jabber (moved to narn)
> DNAT                    net                     LAN:10.24.32.17 tcp	  3478,4560,5222,5223,5269,5280,5347,5444,8010,8888
> DNAT                    net                     LAN:10.24.32.17 udp     3478

Is the firewall host able to connect to the .17 host ?

> Notably MISSING from this list of open ports is 3478, for starters.  If I
> LOCALLY nmap the same host, I get:

Locally from where ?

> Can anyone suggest to me why my firewall is apparently ignoring my
> instructions to accept and DNAT XMPP traffic?

Are the rules being hit ?

Either add ":info:xmpp"
Or check iptables -L -v -n

Actually - why do you have *both* DNAT and ACCEPT rules ?  DNAT (by
default) includes ACCEPT...

-- 
Justin