aMule Forum

Please login or register.

Login with username, password and session length
Advanced search  

News:

We're back! (IN POG FORM)

Author Topic: [MDK] security/shorewall configuration causing uncomprehensible LowID [Solved]  (Read 4505 times)

KoZaki

  • Jr. Member
  • **
  • Karma: 0
  • Offline Offline
  • Posts: 59
  • OS : i586 / athlon languages : french, english, chinese
    • http://c.laloy.free.fr/howtos/linux/

Running aMule-2.0.3 on MandrivaLinux 10.2 (LE 2005 Club) with Freebox v2 (i.e. not a router). Run aMule since years
I've checked amule WiKi & testport (see below)

aMule network configuration unchanged since months:
Code: [Select]
$ amule &
$ Initialising aMule ...
ListenSocket: Ok.
*** TCP socket (ECServer) listening on 0.0.0.0:4712
*** Server UDP socket (TCP+3) at 0.0.0.0:4672
*** TCP socket (TCP) listening on 0.0.0.0:4669
*** Client UDP socket (extended eMule) at 0.0.0.0:4679
ports : tcp/4669 & udp/4679, also opened up in Shorewall :
Code: [Select]
Processing /etc/shorewall/rules...
    Rule "ACCEPT net fw udp 4679,4673 -" added.
    Rule "ACCEPT net fw tcp 4669 -" added.
That worked very fine until yesterday when i shifted from "Standard" to "High" security level, because of 2 servers opened on that PC.

Tesport says confusing stuff (for me at least) :
Code: [Select]
Error: TCP port 4669 is unavailable. Make sure your firewall or router is allowing/forwarding this TCP service port and your ED2K client is running (i.e. aMule, eMule).
   Detailed Error Message
TCP Error 111 Connection refused
   Explanation
*The port is available for connections* but a connection was refused meaning **there is nothing listening on that port**. This most likely means you can use ED2K but your client is not currently running. Try running this test again with an ED2K client running to make sure you can really establish a connection. No info available; this TCP error probably indicates a problem with the networking on your system (i.e. the TCP/IP stack).
   Your public address is
proxy2-a.proxad.net (213.XXX.X.XX)
But aMule is running up with tcp/4669 & udp/4679 specified in Network configuration !?
Also, I'm wondering what's that "proxy2-a.proxad.net (213.XXX.X.XX)" --> should it be the cause of my LowID problem ?

Tests i've done
- Closing Firewall --> no more LowID
- Shifting back to "Standard" Security Level in Drakconf --> same LowID
- closing & restart aMule --> same LowID

Please anybody have a clue to help with that problem ?


BTW, sorry for asking something probably clear enough for advanced users, but amuleWiKi says :
Quote
UDP (outgoing) used for global server searches and global source queries. This is always Server TCP port (in this case 4661) + 4.
when aMule prints this :
Code: [Select]
*** Server UDP socket (TCP+3) at 0.0.0.0:4672So i guess those are differents 2 ports for differents usages
« Last Edit: August 02, 2005, 01:53:23 PM by KoZaki »
Logged
Internet <=> we like to share :D
la FAQ applications Linux

phoenix

  • Evil respawning bird from aMule Dev Team
  • Developer
  • Hero Member
  • *****
  • Karma: 44
  • Offline Offline
  • Posts: 2503
  • The last shadow you'll ever see

Quote
Originally posted by KoZaki
But aMule is running up with tcp/4669 & udp/4679 specified in Network configuration !?
Also, I'm wondering what's that "proxy2-a.proxad.net (213.XXX.X.XX)" --> should it be the cause of my LowID problem ?
If you had a router, I would say that this is the address of your router. Can you check that your IP address is a valid public IP? If you have a router, you also have to set up NAT and port forwarding. If this is not the case, I suggest you find out about that proxy2-a.proxad.net issue, because this is the address that the ed2k server is seeing. Most probably you don't have a valid public address and your ISP is doing NAT.

Quote
Originally posted by KoZaki
Tests i've done
- Closing Firewall --> no more LowID
- Shifting back to "Standard" Security Level in Drakconf --> same LowID
- closing & restart aMule --> same LowID

Please anybody have a clue to help with that problem ?
Did you do some software upgrade lately? If not, I would stick to the theory that your ISP has changed something. I know nothing about your firewall software, but check that your outgoing connections are enabled. The best advice I can give you is this: use ethereal to find out what is really happening.

Quote
Originally posted by KoZaki
BTW, sorry for asking something probably clear enough for advanced users, but amuleWiKi says :
Quote
UDP (outgoing) used for global server searches and global source queries. This is always Server TCP port (in this case 4661) + 4.
when aMule prints this :
Code: [Select]
*** Server UDP socket (TCP+3) at 0.0.0.0:4672So i guess those are differents 2 ports for differents usages
Yes, the first is the UDP port on the server, while the last is the UDP port on the client.
Logged

KoZaki

  • Jr. Member
  • **
  • Karma: 0
  • Offline Offline
  • Posts: 59
  • OS : i586 / athlon languages : french, english, chinese
    • http://c.laloy.free.fr/howtos/linux/

Hi phoenix,

Thank you for the tips (even if i have no clue on how to use ethereal yet uh uh).
You're right, there's no router in here, but a Freebox v2 (ethernet adsl modem) and a switch (D-Link 10/100 switch).

Please would someone will be kind enough to give an exemple : how to use ethereal to find out how to check one has a valid public address, and ir one's ISP is doing NAT ? :baby:

I got it running and started to read the help (so i captured some IP & ports aMule's related) but hey, i've still to work a bit on that ;(

EDIT Here's part of what i got with ethereal when running aMule with no browser open, capturing only stuff related to my IP :
Code: [Select]
No.     Time               Source               Destination         Protocol     Info
210   13.683020     213.186.47.XX  82.XX.XX.XX     eDonkey      eDonkey UDP: Server Info
213   14.292706     83.200.80.XX    82.XX.XX.XX     TCP              4662 > 57154 [ACK] ...
216   14.324730     82.XX.XX.XX     63.149.6.XX      UDP            Source port: 16752 Destination port: 5298
221   14.339043    81.91.65.XXX     82.XX.XX.XX     ICMP          Destination unreachable (Port unreachable)
« Last Edit: July 31, 2005, 06:38:36 PM by KoZaki »
Logged
Internet <=> we like to share :D
la FAQ applications Linux

phoenix

  • Evil respawning bird from aMule Dev Team
  • Developer
  • Hero Member
  • *****
  • Karma: 44
  • Offline Offline
  • Posts: 2503
  • The last shadow you'll ever see

KoZaki,

Take it easy :)

You use ethereal to find out exactly what packets are beeing exchanged between your machine and the server. Ethereal has some filters, which makes it easier for you to see only the interesting packets. Unfortunately, the best way to learn is to try it yourself. You can set up filters on every TCP field you want (IP number, protocol, etc.). I suggest you use a filter on the IP number of the server, so you can monitor every transaction with the server. Also, do not use razorback in this test, because razorback uses a different IP when testing your TCP port. Use a server with fewer users.

You have a valid public IP, if your IP can be reached from the outside world. You can take a look here to see if your IP falls in a non routable range.

With ethereal, it helps a little if you know how the ed2k protocol works, so look here to have an idea.

To figure out whether you will get a high ID or a low ID, you have to understand the following: as soon as you connect to the server, the server will try to connect to your TCP port, to see if it is reachable. If he succeeds in doing so, you get a high ID, else, you get a low id. This is the very start of the conversation, and can be clearly seen in ethereal or any other packet sniffer. There you will be able to see what part of the protocol is failing, and take the necessary measures to fix.

Cheers!
Logged

KoZaki

  • Jr. Member
  • **
  • Karma: 0
  • Offline Offline
  • Posts: 59
  • OS : i586 / athlon languages : french, english, chinese
    • http://c.laloy.free.fr/howtos/linux/

Yes, nice help indeed phoenix.

I guess I'll also make a try from another machine, connected to the same ADSL modem (Freebox v2) to be sure it's not Mandriva that has gone a bit mad with filter.

Remember when i tested without Shorewall Firewall, aMule worked like a charm ?

ethereal i will need it sooner or later, but right now I'm building my first Linux private network with 2 servers running, so i'm copying your help locally
Logged
Internet <=> we like to share :D
la FAQ applications Linux

KoZaki

  • Jr. Member
  • **
  • Karma: 0
  • Offline Offline
  • Posts: 59
  • OS : i586 / athlon languages : french, english, chinese
    • http://c.laloy.free.fr/howtos/linux/

Got it running fine back :)

I absolutlely don't know why there suddently was "eth0" in /etc/shorewall/interfaces (or ~/masq can't remember). But removing this made my network all sudden back to normal.

- no more LowID with aMule
- FTP and Zope server back to life for friends
Logged
Internet <=> we like to share :D
la FAQ applications Linux

phoenix

  • Evil respawning bird from aMule Dev Team
  • Developer
  • Hero Member
  • *****
  • Karma: 44
  • Offline Offline
  • Posts: 2503
  • The last shadow you'll ever see

Congratulations! :)

Have a nice aMule experience ;)
Logged

KoZaki

  • Jr. Member
  • **
  • Karma: 0
  • Offline Offline
  • Posts: 59
  • OS : i586 / athlon languages : french, english, chinese
    • http://c.laloy.free.fr/howtos/linux/

La suite.

À nouveau eu ce problème, cette fois après avoir changé d'IP (because routeur / firewall installé en amont).
Le problème était le même, dans /etc/shorewall/masq : un eth0 qui s'ajoute sans que je comprenne pourquoi :
Code: [Select]
###############################################################################
#INTERFACE        SUBNET ADDRESS PROTO PORT(S)
# eth0 ### string commenté sinon probs : shorewall ne part pas & aMule LowID
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
Logged
Internet <=> we like to share :D
la FAQ applications Linux