1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

telnet through firewall to unix box

Discussion in 'Networking (Hardware & Software)' started by Scott Smith, 2005/10/14.

  1. 2005/10/14
    Scott Smith

    Scott Smith Inactive Alumni Thread Starter

    Joined:
    2002/01/12
    Messages:
    1,950
    Likes Received:
    4
    Is port 23 the only port that needs to be forwarded to local IP?

    Unix guy needs to get to box on LAN to do some maintence via telnet.

    I have 23 forwarded but no workie. Am I missing something?

    I will verify telnet works locally in the morning but wanted a heads up to expect anythng else.

    Thanks,
     
    Scott Smith,
    #1
  2. 2005/10/14
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    telent = dangerous

    Some examples of inherently insecure services include servers that require passwords or passphrases for authentication (in itself, a secure feature), but fail to encrypt the passwords as they are sent over the wire to the authenticating service. Telnet and FTP are two such services. A packet sniffing device set between a remote user and the telnet server can easily be set to steal passwords (especially if the telnet user happens to switch to an administrative user during a telnet session).

    Better to install openssh on the unix box and then remotely connect using an ssh client command shell or a gui openssh client like winscp, all free opensource apps. (I use winscp all the time)

    http://www.openssh.com/
    http://winscp.net/eng/index.php
     
    TonyT,
    #2


  3. to hide this advert.

  4. 2005/10/14
    Scott Smith

    Scott Smith Inactive Alumni Thread Starter

    Joined:
    2002/01/12
    Messages:
    1,950
    Likes Received:
    4
    Yea I guess I should have mentioned it's only for one day. Plus if I can get the telnet session to work I can do WAN IP filtering.
     
    Scott Smith,
    #3
  5. 2005/10/15
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    OK. To allow telnet pass through in the router you must set up port forwarding for port 23 (udp and tcp).

    If telnet session is for a short time period you could just put the unix box in the router's dmz and all open ports on the box would be accessable from outside the lan.

    If will regularly need remote telnet acces then setup port forwarding to use an uncommon http port for telnet, such as 8081, and config the unix telent daemon to use that port instead of port 23. This way outsiders doing port scans for telnet daemons won't be able to detect the running telnet daemon because someone looking for it will be scanning for opened port 25s. But if really need regular access then best to use ssh.

    Another solution, one that I use for my 2 Debian linus boxes, is to run Webmin with the desired modules. Webmin allows secure access to unix configs via the browser from anywhere, but you still need to config port forwarding the the router for webmin.
    http://www.webmin.com/
     
    TonyT,
    #4
  6. 2005/10/15
    Scott Smith

    Scott Smith Inactive Alumni Thread Starter

    Joined:
    2002/01/12
    Messages:
    1,950
    Likes Received:
    4
    Thanks Tony,

    I had already forwarded port 23 before I had even posted this and it wont work.

    I think I may have stumbled across the problem but I cant get any verification of my theroy.

    Whoever set up the LAN origionally did some things kinda backwords.

    The UNIX box LAN IP is 10.10.10.1
    The connection to the internet through a DSL modem is routed through D Link router. The routers address is 10.10.10.126
    The 2003 Server Domain Controller is 10.10.10.5
    3389, 80, 25, 110, all forward to 10.10.10.5 flawlesly.

    My theroy is there is something in the routers code that prevents forwarding on .1 to prevent the router from being hacked. The router comes out of the box configured as .1.
    No one at Dlink would verify that. I requested a Level 3 tech but that didnt happen.
    The simple thing to do to prove my theroy is move the UNIX box off .1 and see if I could telnet through the router. But that feat will be impossible due to the fact there are around 70 production machines connecting to the UNIX box via Tiny Term around the clock.

    So my next step is to replace the Caymon DSL Modem and Dlink Router with a Netopia DSL Modem/Router/Firewall that comes out of the box with a .254 IP so maybe .1 can be forwarded.

    Will Probably be Tuesday or Wedensday before the Netopia comes in.

    Oh and one more thing. This is a 10 year old Unisys box that all it's running is batch information for a food processing plant. "It aint exactly NASA stuff on there" :D :D
     
    Scott Smith,
    #5
  7. 2005/10/15
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Then just try putting the box in the DMZ. That way all traffic looking for that box will passs through. If it doesn't pass through then you know for sure that the reason is the .1 address. Also, what is the address of the router? Default it's 192.168.1.1, but that too can be changed in the router config and may have been changed to something like 10.10.10.0.

    also, the nix box may have it's own iptables firewall blocking telnet port.
     
    TonyT,
    #6
  8. 2005/10/15
    Scott Smith

    Scott Smith Inactive Alumni Thread Starter

    Joined:
    2002/01/12
    Messages:
    1,950
    Likes Received:
    4
    10.10.10.126
     
    Scott Smith,
    #7
  9. 2005/10/16
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    try the dmz method and post results.

    also, I believe dlink has advanced: editing firewall rules option similar to filters. maybe a rule that allows telnet to the server....
     
    TonyT,
    #8
  10. 2005/10/16
    Scott Smith

    Scott Smith Inactive Alumni Thread Starter

    Joined:
    2002/01/12
    Messages:
    1,950
    Likes Received:
    4
    Tony I had tried putting the box in the DMZ (Just forgot to mention it) but it didn't work.

    I'll try to get you some screen shots in the morning.
     
    Scott Smith,
    #9
  11. 2005/10/16
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    OK then.
    so, current ip address of box is 10.10.10.1 & around 70 production machines connecting routinely via Tiny Term , thus dlink is allowing requests for that ip to pass through locally, so there's no logical reason that the dlink should deny wan pass through to the box if enabled in the dlink. And when box in dmz and wan pass tghrough is still denied then that leads me to believe that either a telnet daemon is not running on the box or else there is another daemon running on the box that prevents & won't ack requests to port 23 (nix firewall such as iptables)

    what os on the unisys box??
     
    TonyT,
    #10
  12. 2005/10/16
    Scott Smith

    Scott Smith Inactive Alumni Thread Starter

    Joined:
    2002/01/12
    Messages:
    1,950
    Likes Received:
    4
    Local requests would never go through the router.


    I will have to find that out but it's my understanding it's a 10 year old version of Unix by Unisys.

    The application running is called Cimpro.

    http://www.profprog.com/cimpro.html
     
    Scott Smith,
    #11
  13. 2005/10/16
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    If the unix box is connected to the dlink, then yes, all lan (local) requests to it go through the dlink router, at least they must pass through the router's built in switch. To access the unix box from the wan side, the unix box must have a fully qualified domain name registered with dns servers, else the remote user must access it using the ip address assigned by the isp.
     
    Last edited: 2005/10/16
    TonyT,
    #12
  14. 2005/10/21
    Scott Smith

    Scott Smith Inactive Alumni Thread Starter

    Joined:
    2002/01/12
    Messages:
    1,950
    Likes Received:
    4
    Woohoo mission acomplished!

    The Unix box was installed before there ever was an internet connection at this facility.

    Therefore without a gateway in the UNIX Box it didnt know where to send the session request to once the port 23 client request was received.

    DOH!!
     
    Scott Smith,
    #13
  15. 2005/10/22
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    wow! That makes so much sense, but is one of those things that is burried deep as a cause of the problem. Must have taken some concentrated digging at config files to locate that!
     
    TonyT,
    #14
  16. 2005/10/22
    Scott Smith

    Scott Smith Inactive Alumni Thread Starter

    Joined:
    2002/01/12
    Messages:
    1,950
    Likes Received:
    4
    Tony,

    What tipped me off was when I did a netstat on the Unix box I noticed all of the clients were connected with ports up in the 58,000 area.

    Then I did a netstat -rn and there was no default along with the Gateway was 127.0.0.1

    That's when "The lights came on in Georgia" and I realised telnet is a session just like every other activity and only receives the request on port 23 but sets up the session on a wide range of ports. The unix box didnt know where to route the session to. :rolleyes:
     
    Scott Smith,
    #15

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...