Unable to connect to the API #42

WEBudoGT · 2022-01-11T18:46:01Z

WEBudoGT
Jan 11, 2022

I got it installed on a Debian 10 server vía Ansible method.
Got into some trouble on the first few attempts but finally got ansible to finish without any errors.
I see nginx, freeswitch and redis running and getting their ports on localhost (only nginx on public side as expected) as it's shown on:

netstat -tulnp

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 546/redis-server 12
tcp 0 0 127.0.0.1:8080 0.0.0.0:* LISTEN 479/python3
tcp 0 0 127.0.0.1:8021 0.0.0.0:* LISTEN 821/freeswitch
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 516/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 796/exim4
tcp 0 0 157.XXX.XXX.XXX:8443 0.0.0.0:* LISTEN 538/nginx: master p
tcp6 0 0 ::1:6379 :::* LISTEN 546/redis-server 12
tcp6 0 0 :::4369 :::* LISTEN 1/init
tcp6 0 0 :::22 :::* LISTEN 516/sshd
tcp6 0 0 ::1:25 :::* LISTEN 796/exim4
udp 0 0 127.0.0.1:323 0.0.0.0:* 495/chronyd
udp6 0 0 ::1:323 :::* 495/chronyd

I'm unable to access the api or apidocs using https://157.XXX.XXX.XXX:8443/apidocs (connection timed out)
If I run curl to access localhost:8080 (which is proxied by nginx) I get this:

`# curl http://127.0.0.1:8080/apidocs

<!DOCTYPE html>
<html>
<head>
<title>LIBRESBC - ReDoc</title>
<!-- needed for adaptive design -->
<meta charset="utf-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1">

<link href="https://fonts.googleapis.com/css?family=Montserrat:300,400,700|Roboto:300,400,700" rel="stylesheet">

<link rel="shortcut icon" href="https://fastapi.tiangolo.com/img/favicon.png">
<!--
ReDoc doesn't change outer page styles
-->
<style>
  body {
    margin: 0;
    padding: 0;
  }
</style>
</head>
<body>
<redoc spec-url="/openapi.json"></redoc>
<script src="https://cdn.jsdelivr.net/npm/redoc@next/bundles/redoc.standalone.js"> </script>
</body>
</html>`

I can't find why it doesn't allow me to access from outside. I even tried to stop nftables service.

Please help

Answered by hnimminh

Jan 13, 2022

Thanks @WEBudoGT
Seem like the line of port for firewall has been removed when you edit inventory file.

libresbc/build/ansible/inventories/production/hosts.yml

Line 48 in a92ab6b

- 8443

you can add back the port 8443 and rerun playbook with tag -t libre
ansible-playbook playbooks/deployment.yml -i inventories/production -l "<machine-name>" -t "libre"

or you can just do simple command to solve this immediately:
nft add rule inet LIBREFW INBOUND tcp dport 8443 ip saddr <your-ip-address>counter accept

example
nft add rule inet LIBREFW INBOUND tcp dport 8444 ip saddr 1.1.1.1/32 counter accept

View full answer

hnimminh · 2022-01-13T07:04:26Z

hnimminh
Jan 13, 2022
Maintainer

hi @WEBudoGT,
If you don't mind can you share the output of this command nft list ruleset ?

1 reply

WEBudoGT Jan 13, 2022
Author

Hello @hnimminh , thanks for replying :)
Sure, here it is:

nft list ruleset

table inet LIBREFW {
set WhiteHole {
type ipv4_addr
}

set BlackHole {
	type ipv4_addr
}

set TemporaryBlocks {
	type ipv4_addr
	size 65535
	timeout 15m
}

chain INBOUND {
	type filter hook input priority 0; policy drop;
	iifname "lo" ip saddr != 127.0.0.0/8 counter packets 0 bytes 0 drop
	iifname "lo" ip6 saddr != ::1 counter packets 0 bytes 0 drop
	iifname "lo" accept
	iifname != "lo" ip daddr 127.0.0.0/8 counter packets 0 bytes 0 drop
	ip saddr @WhiteHole accept
	ip saddr @BlackHole drop
	ip saddr @TemporaryBlocks drop
	ip frag-off & 8191 != 0 counter packets 0 bytes 0 drop comment "IP FRAGMENTS"
	tcp flags != syn ct state new drop comment "FIRST MEET BUT NOT SYN"
	tcp flags & (fin | syn) == fin | syn drop comment "NEW BUT FIN"
	tcp flags & (syn | rst) == syn | rst drop comment "NEVER MET BUT RESET"
	tcp flags & (fin | syn | rst | psh | ack | urg) < fin drop comment "ATTACK"
	tcp flags & (fin | syn | rst | psh | ack | urg) == fin | psh | urg drop comment "XMAS ATTACK"
	tcp flags & (fin | syn | rst | psh | ack | urg) == 0x0 counter packets 0 bytes 0 drop comment "NULL"
	tcp flags syn tcp option maxseg size 1-536 counter packets 0 bytes 0 drop comment "TCPSEGSIZE"
	ct state invalid counter packets 0 bytes 0 drop comment "INVALID STATE"
	ct state { established, related } counter packets 34 bytes 2380 accept
	tcp dport ssh ct state new limit rate over 5/minute add @TemporaryBlocks { ip saddr timeout 10m }  counter packets 0 bytes 0 comment "SSH BRUTEFORCE"
	tcp dport { ssh } ip saddr { 0.0.0.0-255.255.255.255 } tcp sport { 1024-65535 } counter packets 0 bytes 0 accept
	icmp type echo-request limit rate 1/second counter packets 0 bytes 0 accept
	counter packets 3 bytes 144 drop
}

chain OUTBOUND {
	type filter hook output priority 0; policy accept;
}

chain FORWARD {
	type filter hook forward priority 0; policy drop;
}

}

hnimminh · 2022-01-13T18:19:34Z

hnimminh
Jan 13, 2022
Maintainer

Thanks @WEBudoGT
Seem like the line of port for firewall has been removed when you edit inventory file.

libresbc/build/ansible/inventories/production/hosts.yml

Line 48 in a92ab6b

- 8443

you can add back the port 8443 and rerun playbook with tag -t libre
ansible-playbook playbooks/deployment.yml -i inventories/production -l "<machine-name>" -t "libre"

or you can just do simple command to solve this immediately:
nft add rule inet LIBREFW INBOUND tcp dport 8443 ip saddr <your-ip-address>counter accept

example
nft add rule inet LIBREFW INBOUND tcp dport 8444 ip saddr 1.1.1.1/32 counter accept

3 replies

WEBudoGT Jan 19, 2022
Author

Sorry for my late reply.
I did the command to solve immediately using my IP address:

nft add rule inet LIBREFW INBOUND tcp dport 8443 ip saddr 181.209.152.238/32 counter accept

Now it looks lik:

table inet LIBREFW {
set WhiteHole {
type ipv4_addr
}

set BlackHole {
	type ipv4_addr
}

set TemporaryBlocks {
	type ipv4_addr
	size 65535
	timeout 15m
}

chain INBOUND {
	type filter hook input priority 0; policy drop;
	iifname "lo" ip saddr != 127.0.0.0/8 counter packets 0 bytes 0 drop
	iifname "lo" ip6 saddr != ::1 counter packets 0 bytes 0 drop
	iifname "lo" accept
	iifname != "lo" ip daddr 127.0.0.0/8 counter packets 0 bytes 0 drop
	ip saddr @WhiteHole accept
	ip saddr @BlackHole drop
	ip saddr @TemporaryBlocks drop
	ip frag-off & 8191 != 0 counter packets 0 bytes 0 drop comment "IP FRAGMENTS"
	tcp flags != syn ct state new drop comment "FIRST MEET BUT NOT SYN"
	tcp flags & (fin | syn) == fin | syn drop comment "NEW BUT FIN"
	tcp flags & (syn | rst) == syn | rst drop comment "NEVER MET BUT RESET"
	tcp flags & (fin | syn | rst | psh | ack | urg) < fin drop comment "ATTACK"
	tcp flags & (fin | syn | rst | psh | ack | urg) == fin | psh | urg drop comment "XMAS ATTACK"
	tcp flags & (fin | syn | rst | psh | ack | urg) == 0x0 counter packets 0 bytes 0 drop comment "NULL"
	tcp flags syn tcp option maxseg size 1-536 counter packets 0 bytes 0 drop comment "TCPSEGSIZE"
	ct state invalid counter packets 0 bytes 0 drop comment "INVALID STATE"
	ct state { established, related } counter packets 440 bytes 32098 accept
	tcp dport ssh ct state new limit rate over 5/minute add @TemporaryBlocks { ip saddr timeout 10m }  counter packets 0 bytes 0 comment "SSH BRUTEFORCE"
	tcp dport { ssh } ip saddr { 0.0.0.0-255.255.255.255 } tcp sport { 1024-65535 } counter packets 0 bytes 0 accept
	icmp type echo-request limit rate 1/second counter packets 0 bytes 0 accept
	counter packets 257 bytes 15136 drop
	tcp dport 8443 ip saddr 181.209.152.238 counter packets 0 bytes 0 accept
}

chain OUTBOUND {
	type filter hook output priority 0; policy accept;
}

chain FORWARD {
	type filter hook forward priority 0; policy drop;
}

}

But I'm still unable to access the API.
Only if I stop nftables service I'm able to access it.
Is it because I have multiple interfaces? eth0, eth0:1, eth1 and lo

WEBudoGT Jan 19, 2022
Author

Sorry, as I don't know anything about iftables (I'm used to iptables hehe) I hadn't noticed the drop rule came before the new added rule.
Because I still have not clear how to make a rule take precedence over others, I edited nftables.conf and put the one you sugested before the drop rule and got the API responsive.

Thanks for your support, and sorry I made you spend some time explaining something out of the scope of your project ;)

Have a good one!

hnimminh Jan 20, 2022
Maintainer

Hi @WEBudoGT,
You remind that I forgot that new rule will be appended to the end of rules, can you try to do following:

echo "tcp dport 8443 ip saddr 181.209.152.238/32 counter accept" >> /etc/preset.libre.nft
nft -f /etc/nftables.conf

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unable to connect to the API #42

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 4 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Unable to connect to the API #42

WEBudoGT Jan 11, 2022

netstat -tulnp

Replies: 2 comments · 4 replies

hnimminh Jan 13, 2022 Maintainer

WEBudoGT Jan 13, 2022 Author

nft list ruleset

hnimminh Jan 13, 2022 Maintainer

WEBudoGT Jan 19, 2022 Author

WEBudoGT Jan 19, 2022 Author

hnimminh Jan 20, 2022 Maintainer

WEBudoGT
Jan 11, 2022

Replies: 2 comments 4 replies

hnimminh
Jan 13, 2022
Maintainer

WEBudoGT Jan 13, 2022
Author

hnimminh
Jan 13, 2022
Maintainer

WEBudoGT Jan 19, 2022
Author

WEBudoGT Jan 19, 2022
Author

hnimminh Jan 20, 2022
Maintainer