telnet on local LAN question

[Paul Allen Newell]

On 8/16/2011 10:51 PM, Andre Speelmans wrote:

I have been going through all the responses I got so far and am now in 
process of going through this. I can't test the 127.0.0.1 as I've got my 
systems somewhat horked trying to sort things out ... after this email I 
am backing everything up to "factory install" to try out this and the 
other suggestions for tests.

What I do know at this point is that it is not a matter of name 
resolution as I tried telnet <name> 22 to use ssh which I know works and 
the name resolved with a connection made (though utterly useless to use).

Aside from the concerns about "why is my network the way it is" which I 
intend to address, I am pretty certain the problem is in iptables. I can 
telnet to cs.cmu.edu, so I know telnet is working on all my machines.

My iptables is the default per F14 installation:
+++
# Generated by iptables-save v1.4.9 on Tue Aug 16 22:13:30 2011
# Used command "iptables-save > iptables_F14_ORIGINAL_yoyo"
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [9950:627381]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Aug 16 22:13:30 2011
+++

I don't understand the OUTPUT as it is different for each of the three 
machines I am working with, but from what I can tell from the iptables 
literature, my issue is with INPUT

I added a LOG on input immediately before rejecting and can see that, on 
the destination machine, there is an entry corresponding to the request 
"telnet <name>" (note I have dropped the port number to allow telnet to 
use its default port):
+++
Aug 16 22:39:58 chalupa kernel: [ 2784.447580] IN=eth0 OUT= 
MAC=00:e0:81:00:4c:b0:00:e0:81:00:62:94:08:00 SRC=192.168.2.11 
DST=192.168.2.10 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=49145 DF PROTO=TCP 
SPT=36385 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0
+++

I don't see anything in /var/log/message on the machine that I did the 
telnet request on (which would be the 192.168.2.11 in the above message)

I have been trying what I think is the correct edit in all permuations I 
can think of ... as in:
+++
iptables -I INPUT <where every the log entry is> -{s,d} 
192.168.2.{10,11} -p tcp -{destination,source}-port telnet -j ACCEPT
+++

I am not having success and the messages in the log are showing me that 
I am making a mess. One of the interesting things is I am now getting 
"connection refused" rather than "no route to host" and I need to see 
what change I made caused that (which is also interesting as I would 
have expected "connection refused" if the resolution was "REJECT"?)

If I know what 192.168.2.x machines I want to be able to telnet to and I 
modify all machines to have the necessary in iptables to allow a telnet 
to/from, what am I missing?

Thanks in advance (this iptables stuff is a bit daunting ...),
Paul