Re: ejabberd DNAT problem

Phil Stracchino <[email protected]> Tue, 18 Apr 2023 00:02:56 -0400
Newsgroups gmane.comp.security.shorewall
Organization Babylon Communications
Message-ID <[email protected]>
On 4/17/23 23:25, Justin Pryzby wrote:
> On Mon, Apr 17, 2023 at 10:56:17PM -0400, Phil Stracchino wrote:
>> Greetings,
>>
>> I have a weird problem.  I had a power interruption today during a generator
>> install, and when everything came back up afterwards, my XMPP server
>> (ejabberd) is not receiving any external connections.  No firewall rules
>> changed.
> 
> You said they didn't change .. but didn't change since when ?

Several months, and that change was only to move that service to a 
different IP.  Before that?  These rules haven't changed in years.

>> The relevant rules in my Shorewall config are:
>>
>> Jabberd(ACCEPT)         all                     all
>> JabberPlain(ACCEPT)     all                     all
>> JabberSecure(ACCEPT)    all                     all
>>
>> ...
>>
>> # Jabber (moved to narn)
>> DNAT                    net                     LAN:10.24.32.17 tcp	  3478,4560,5222,5223,5269,5280,5347,5444,8010,8888
>> DNAT                    net                     LAN:10.24.32.17 udp     3478
> 
> Is the firewall host able to connect to the .17 host ?

Yes, without a problem.  And vice versa.

>> Notably MISSING from this list of open ports is 3478, for starters.  If I
>> LOCALLY nmap the same host, I get:
> 
> Locally from where ?

10.24.32.10.  "Locally" as in "from the same network segment", not as in 
"from localhost".

>> Can anyone suggest to me why my firewall is apparently ignoring my
>> instructions to accept and DNAT XMPP traffic?
> 
> Are the rules being hit ?
> 
> Either add ":info:xmpp"

Add that to what?

> Or check iptables -L -v -n

This is a Ubiquiti appliance that does not expose the iptables command. 
They do NOT want you to frob the firewall rules by hand.

> Actually - why do you have *both* DNAT and ACCEPT rules ?  DNAT (by
> default) includes ACCEPT...


OK, so that's redundant then.  I thought I had to do those separately. 
There isn't a macro, to my knowledge, that accepts ALL of the 
XMPP-related ports *and* DNATs them in a single step.  Or is there 
something I'm missing?

Is there a better way to do this?

Are the ACCENT and DNAT rules possibly *interfering with* each other? 
Wouldn't be the first time I've inadvertently constructed a footgun...



-- 
   Phil Stracchino
   Babylon Communications
   [email protected]
   [email protected]
   Landline: +1.603.293.8485
   Mobile:   +1.603.998.6958