Successful connect to a closed port with FirewallDFC19 FirewallD debugging help requested: ports not forwardingCentos 7.1 Firewalld source address restrictionCentOS 7 firewall-cmd not foundfirewalld not blocking docker container portsFirewalld - Logging denied packets enabled - not loggingfirewalld masquerade controlPort does not nping in Centos 7firewalld port forwarding not working in centOSHow do I create a rule with firewalld that uses a host nameWhy isn't firewalld filtering the services running in my Docker containers?
Arthur Somervell: 1000 Exercises - Meaning of this notation
Is it possible to do 50 km distance without any previous training?
Prove that NP is closed under karp reduction?
Service Entrance Breakers Rain Shield
The Two and the One
Email Account under attack (really) - anything I can do?
I’m planning on buying a laser printer but concerned about the life cycle of toner in the machine
The use of multiple foreign keys on same column in SQL Server
What do you call a Matrix-like slowdown and camera movement effect?
Is it important to consider tone, melody, and musical form while writing a song?
Why did the Germans forbid the possession of pet pigeons in Rostov-on-Don in 1941?
Is it unprofessional to ask if a job posting on GlassDoor is real?
Can a Warlock become Neutral Good?
Example of a continuous function that don't have a continuous extension
strToHex ( string to its hex representation as string)
How is it possible to have an ability score that is less than 3?
How do I create uniquely male characters?
How is the claim "I am in New York only if I am in America" the same as "If I am in New York, then I am in America?
Today is the Center
Did Shadowfax go to Valinor?
Animated Series: Alien black spider robot crashes on Earth
Can I ask the recruiters in my resume to put the reason why I am rejected?
How much RAM could one put in a typical 80386 setup?
Minkowski space
Successful connect to a closed port with FirewallD
FC19 FirewallD debugging help requested: ports not forwardingCentos 7.1 Firewalld source address restrictionCentOS 7 firewall-cmd not foundfirewalld not blocking docker container portsFirewalld - Logging denied packets enabled - not loggingfirewalld masquerade controlPort does not nping in Centos 7firewalld port forwarding not working in centOSHow do I create a rule with firewalld that uses a host nameWhy isn't firewalld filtering the services running in my Docker containers?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
Please help to understand why FirewallD allows me to connect to one port but blocks the second.
There is a Docker container with transmission:
5cf144eed6f2 maksim77/transmission "/bin/sh -c 'transmis" 14 hours ago Up 16 minutes 0.0.0.0:9091->9091/tcp, 0.0.0.0:51413->51413/tcp transmission
Both ports (9091 and 51413) are not listed in FirewallD rules:
root@host:maksim #firewall-cmd --list-all-zones | grep active
public (default, active)
trusted (active)
root@host:maksim #firewall-cmd --list-all --zone trusted
trusted (active)
interfaces: docker0
sources:
services:
ports: 4243/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
root@host:maksim #firewall-cmd --list-all --zone public
public (default, active)
interfaces: enp9s0
sources:
services: dhcpv6-client ftp http ssh
ports: 41387/tcp 1900/udp 50213/tcp 8200/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
But! The connection is successful for port 9091 but not for port 51413. Port 51413 is available only for 127.0.0.1
docker centos7 firewalld
asked Oct 15 '15 at 9:49
MSemochkinMSemochkin
59057
add a comment |
Please help to understand why FirewallD allows me to connect to one port but blocks the second.
There is a Docker container with transmission:
5cf144eed6f2 maksim77/transmission "/bin/sh -c 'transmis" 14 hours ago Up 16 minutes 0.0.0.0:9091->9091/tcp, 0.0.0.0:51413->51413/tcp transmission
Both ports (9091 and 51413) are not listed in FirewallD rules:
root@host:maksim #firewall-cmd --list-all-zones | grep active
public (default, active)
trusted (active)
root@host:maksim #firewall-cmd --list-all --zone trusted
trusted (active)
interfaces: docker0
sources:
services:
ports: 4243/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
root@host:maksim #firewall-cmd --list-all --zone public
public (default, active)
interfaces: enp9s0
sources:
services: dhcpv6-client ftp http ssh
ports: 41387/tcp 1900/udp 50213/tcp 8200/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
But! The connection is successful for port 9091 but not for port 51413. Port 51413 is available only for 127.0.0.1
docker centos7 firewalld
asked Oct 15 '15 at 9:49
MSemochkinMSemochkin
59057
Can yo tell which interface accepts the connection for port 9091? Do you know which interface should've handled 51413?
– Dani_l
Oct 15 '15 at 9:55
netstat showstcp6 0 0 :::9091 :::* LISTEN 9807/docker-proxyI think 51413 needs to be the same.
– MSemochkin
Oct 15 '15 at 10:10
Make sure you didEXPOSE 51413and you did not setbind-address-ipv4in transmission's config file.
– Michael Hampton♦
Oct 15 '15 at 14:06
Of course i EXPOSE both port. bind-address-ipv4 = "0.0.0.0"
– MSemochkin
Oct 15 '15 at 15:05
add a comment |
Please help to understand why FirewallD allows me to connect to one port but blocks the second.
There is a Docker container with transmission:
5cf144eed6f2 maksim77/transmission "/bin/sh -c 'transmis" 14 hours ago Up 16 minutes 0.0.0.0:9091->9091/tcp, 0.0.0.0:51413->51413/tcp transmission
Both ports (9091 and 51413) are not listed in FirewallD rules:
root@host:maksim #firewall-cmd --list-all-zones | grep active
public (default, active)
trusted (active)
root@host:maksim #firewall-cmd --list-all --zone trusted
trusted (active)
interfaces: docker0
sources:
services:
ports: 4243/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
root@host:maksim #firewall-cmd --list-all --zone public
public (default, active)
interfaces: enp9s0
sources:
services: dhcpv6-client ftp http ssh
ports: 41387/tcp 1900/udp 50213/tcp 8200/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
But! The connection is successful for port 9091 but not for port 51413. Port 51413 is available only for 127.0.0.1
docker centos7 firewalld
asked Oct 15 '15 at 9:49
MSemochkinMSemochkin
59057
Please help to understand why FirewallD allows me to connect to one port but blocks the second.
There is a Docker container with transmission:
5cf144eed6f2 maksim77/transmission "/bin/sh -c 'transmis" 14 hours ago Up 16 minutes 0.0.0.0:9091->9091/tcp, 0.0.0.0:51413->51413/tcp transmission
Both ports (9091 and 51413) are not listed in FirewallD rules:
root@host:maksim #firewall-cmd --list-all-zones | grep active
public (default, active)
trusted (active)
root@host:maksim #firewall-cmd --list-all --zone trusted
trusted (active)
interfaces: docker0
sources:
services:
ports: 4243/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
root@host:maksim #firewall-cmd --list-all --zone public
public (default, active)
interfaces: enp9s0
sources:
services: dhcpv6-client ftp http ssh
ports: 41387/tcp 1900/udp 50213/tcp 8200/tcp
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
But! The connection is successful for port 9091 but not for port 51413. Port 51413 is available only for 127.0.0.1
docker centos7 firewalld
docker centos7 firewalld
asked Oct 15 '15 at 9:49
MSemochkinMSemochkin
59057
asked Oct 15 '15 at 9:49
MSemochkinMSemochkin
59057
asked Oct 15 '15 at 9:49
MSemochkinMSemochkin
59057
asked Oct 15 '15 at 9:49
MSemochkinMSemochkin
59057
asked Oct 15 '15 at 9:49
MSemochkinMSemochkin
59057
59057
Can yo tell which interface accepts the connection for port 9091? Do you know which interface should've handled 51413?
– Dani_l
Oct 15 '15 at 9:55
netstat showstcp6 0 0 :::9091 :::* LISTEN 9807/docker-proxyI think 51413 needs to be the same.
– MSemochkin
Oct 15 '15 at 10:10
Make sure you didEXPOSE 51413and you did not setbind-address-ipv4in transmission's config file.
– Michael Hampton♦
Oct 15 '15 at 14:06
Of course i EXPOSE both port. bind-address-ipv4 = "0.0.0.0"
– MSemochkin
Oct 15 '15 at 15:05
add a comment |
Can yo tell which interface accepts the connection for port 9091? Do you know which interface should've handled 51413?
– Dani_l
Oct 15 '15 at 9:55
netstat showstcp6 0 0 :::9091 :::* LISTEN 9807/docker-proxyI think 51413 needs to be the same.
– MSemochkin
Oct 15 '15 at 10:10
Make sure you didEXPOSE 51413and you did not setbind-address-ipv4in transmission's config file.
– Michael Hampton♦
Oct 15 '15 at 14:06
Of course i EXPOSE both port. bind-address-ipv4 = "0.0.0.0"
– MSemochkin
Oct 15 '15 at 15:05
Can yo tell which interface accepts the connection for port 9091? Do you know which interface should've handled 51413?
– Dani_l
Oct 15 '15 at 9:55
Can yo tell which interface accepts the connection for port 9091? Do you know which interface should've handled 51413?
– Dani_l
Oct 15 '15 at 9:55
netstat shows
tcp6 0 0 :::9091 :::* LISTEN 9807/docker-proxy I think 51413 needs to be the same.– MSemochkin
Oct 15 '15 at 10:10
netstat shows
tcp6 0 0 :::9091 :::* LISTEN 9807/docker-proxy I think 51413 needs to be the same.– MSemochkin
Oct 15 '15 at 10:10
Make sure you did
EXPOSE 51413 and you did not set bind-address-ipv4 in transmission's config file.– Michael Hampton♦
Oct 15 '15 at 14:06
Make sure you did
EXPOSE 51413 and you did not set bind-address-ipv4 in transmission's config file.– Michael Hampton♦
Oct 15 '15 at 14:06
Of course i EXPOSE both port. bind-address-ipv4 = "0.0.0.0"
– MSemochkin
Oct 15 '15 at 15:05
Of course i EXPOSE both port. bind-address-ipv4 = "0.0.0.0"
– MSemochkin
Oct 15 '15 at 15:05
add a comment |
1 Answer
1
active
oldest
votes
You don't see these in firewalld because Docker opens the ports itself, outside of firewalld.
To see what Docker is doing, run:
iptables -L DOCKER
iptables -t nat -L DOCKER
Docker will open firewall ports itself for any port your containers EXPOSE, unless you explicitly disable this. It also allows containers which need to communicate with each other to do so, so you should leave this enabled unless you really know what you're doing.
answered Oct 15 '15 at 13:08
Michael Hampton♦Michael Hampton
174k27319644
Thank you! It is now clear why it is not visible in the output ports on the FirewallD. According to iptables both ports are open but port 51413 is closed from the outside. Whereas at the request of localhost it is available.
– MSemochkin
Oct 15 '15 at 15:13
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f729134%2fsuccessful-connect-to-a-closed-port-with-firewalld%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
You don't see these in firewalld because Docker opens the ports itself, outside of firewalld.
To see what Docker is doing, run:
iptables -L DOCKER
iptables -t nat -L DOCKER
Docker will open firewall ports itself for any port your containers EXPOSE, unless you explicitly disable this. It also allows containers which need to communicate with each other to do so, so you should leave this enabled unless you really know what you're doing.
answered Oct 15 '15 at 13:08
Michael Hampton♦Michael Hampton
174k27319644
Thank you! It is now clear why it is not visible in the output ports on the FirewallD. According to iptables both ports are open but port 51413 is closed from the outside. Whereas at the request of localhost it is available.
– MSemochkin
Oct 15 '15 at 15:13
add a comment |
You don't see these in firewalld because Docker opens the ports itself, outside of firewalld.
To see what Docker is doing, run:
iptables -L DOCKER
iptables -t nat -L DOCKER
Docker will open firewall ports itself for any port your containers EXPOSE, unless you explicitly disable this. It also allows containers which need to communicate with each other to do so, so you should leave this enabled unless you really know what you're doing.
answered Oct 15 '15 at 13:08
Michael Hampton♦Michael Hampton
174k27319644
Thank you! It is now clear why it is not visible in the output ports on the FirewallD. According to iptables both ports are open but port 51413 is closed from the outside. Whereas at the request of localhost it is available.
– MSemochkin
Oct 15 '15 at 15:13
add a comment |
You don't see these in firewalld because Docker opens the ports itself, outside of firewalld.
To see what Docker is doing, run:
iptables -L DOCKER
iptables -t nat -L DOCKER
Docker will open firewall ports itself for any port your containers EXPOSE, unless you explicitly disable this. It also allows containers which need to communicate with each other to do so, so you should leave this enabled unless you really know what you're doing.
answered Oct 15 '15 at 13:08
Michael Hampton♦Michael Hampton
174k27319644
You don't see these in firewalld because Docker opens the ports itself, outside of firewalld.
To see what Docker is doing, run:
iptables -L DOCKER
iptables -t nat -L DOCKER
Docker will open firewall ports itself for any port your containers EXPOSE, unless you explicitly disable this. It also allows containers which need to communicate with each other to do so, so you should leave this enabled unless you really know what you're doing.
answered Oct 15 '15 at 13:08
Michael Hampton♦Michael Hampton
174k27319644
edited Oct 15 '15 at 14:03
answered Oct 15 '15 at 13:08
Michael Hampton♦Michael Hampton
174k27319644
answered Oct 15 '15 at 13:08
Michael Hampton♦Michael Hampton
174k27319644
answered Oct 15 '15 at 13:08
Michael Hampton♦Michael Hampton
174k27319644
174k27319644
Thank you! It is now clear why it is not visible in the output ports on the FirewallD. According to iptables both ports are open but port 51413 is closed from the outside. Whereas at the request of localhost it is available.
– MSemochkin
Oct 15 '15 at 15:13
add a comment |
Thank you! It is now clear why it is not visible in the output ports on the FirewallD. According to iptables both ports are open but port 51413 is closed from the outside. Whereas at the request of localhost it is available.
– MSemochkin
Oct 15 '15 at 15:13
Thank you! It is now clear why it is not visible in the output ports on the FirewallD. According to iptables both ports are open but port 51413 is closed from the outside. Whereas at the request of localhost it is available.
– MSemochkin
Oct 15 '15 at 15:13
Thank you! It is now clear why it is not visible in the output ports on the FirewallD. According to iptables both ports are open but port 51413 is closed from the outside. Whereas at the request of localhost it is available.
– MSemochkin
Oct 15 '15 at 15:13
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f729134%2fsuccessful-connect-to-a-closed-port-with-firewalld%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Can yo tell which interface accepts the connection for port 9091? Do you know which interface should've handled 51413?
– Dani_l
Oct 15 '15 at 9:55
netstat shows
tcp6 0 0 :::9091 :::* LISTEN 9807/docker-proxyI think 51413 needs to be the same.– MSemochkin
Oct 15 '15 at 10:10
Make sure you did
EXPOSE 51413and you did not setbind-address-ipv4in transmission's config file.– Michael Hampton♦
Oct 15 '15 at 14:06
Of course i EXPOSE both port. bind-address-ipv4 = "0.0.0.0"
– MSemochkin
Oct 15 '15 at 15:05