fix whonix-ws-firewall

phabricator-migrator · February 19, 2024, 5:52pm

Information

ID: 112
PHID: PHID-TASK-iuj5kstg225ckrdqlrhz
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

See forum thread:

Comments

Patrick

2015-01-26 19:13:25 UTC

Patrick

2015-02-04 02:42:34 UTC

Same issue happening again.
time /usr/lib/anon-shared-helper-scripts/tor_bootstrap_check.py 127.0.0.1 9151 0
Still needs ~ 10 seconds.

Unless the following rule is removed.
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
So some input rule must be missing.

Patrick

2015-02-04 02:54:58 UTC

Cause is a package being blocked. From Whonix-Workstation /var/log/kern.log:
Whonix blocked input4: IN=eth0 OUT= MAC=redacted SRC=10.152.152.10 DST=10.152.152.11 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=redacted DF PROTO=TCP SPT=34628 DPT=113 WINDOW=14600 RES=0x00 SYN URGP=0
No idea why python-stem (or any of its dependencies) needs to do that.

Patrick

2015-02-04 02:58:21 UTC

Adding
iptables -A INPUT -p tcp --dport 113 -j ACCEPT
above
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
fixes it. But I don’t like to fix it by opening that port. A better solution is desired.

Patrick

2015-02-04 03:09:35 UTC

Patrick

2015-02-04 03:17:02 UTC

Patrick

2015-02-04 03:19:58 UTC