[IPv6 ?] Impossible de se connecter à mon serveur mumble

koshie · Février 21, 2016, 2:40pm

Salut,

Je cherche à monter sur mon dédié avec Wheezy (64 bits) un serveur Mumble 1.2.4 (depuis sourceforge car les dépôts ne me propose que la 1.0.*).

Je modifie le murmur.ini :

Murmur configuration file.

General notes:

* Settings in this file are default settings and many of them can be overridden

with virtual server specific configuration via the Ice or DBus interface.

* Due to the way this configuration file is read some rules have to be

followed when specifying variable values (as in variable = value):

* Make sure to quote the value when using commas in strings or passwords.

NOT variable = super,secret BUT variable = “super,secret”

* Make sure to escape special characters like ‘’ or ‘"’ correctly

NOT variable = “”" BUT variable = “”"

NOT regex = \w* BUT regex = \w*

Path to database. If blank, will search for

murmur.sqlite in default locations or create it if not found.

database=

If you wish to use something other than SQLite, you’ll need to set the name

of the database above, and also uncomment the below.

Sticking with SQLite is strongly recommended, as it’s the most well tested

and by far the fastest solution.

#dbDriver=QMYSQL
#dbUsername=
#dbPassword=
#dbHost=
#dbPort=
#dbPrefix=murmur_
#dbOpts=

Murmur defaults to not using D-Bus. If you wish to use dbus, which is one of the

RPC methods available in Murmur, please specify so here.

#dbus=session

Alternate D-Bus service name. Only use if you are running distinct

murmurd processes connected to the same D-Bus daemon.

#dbusservice=net.sourceforge.mumble.murmur

If you want to use ZeroC Ice to communicate with Murmur, you need

to specify the endpoint to use. Since there is no authentication

with ICE, you should only use it if you trust all the users who have

shell access to your machine.

Please see the ICE documentation on how to specify endpoints.

#ice=“tcp -h 127.0.0.1 -p 6502”

Ice primarily uses local sockets. This means anyone who has a

user account on your machine can connect to the Ice services.

You can set a plaintext “secret” on the Ice connection, and

any script attempting to access must then have this secret

(as context with name “secret”).

Access is split in read (look only) and write (modify)

operations. Write access always includes read access,

unless read is explicitly denied (see note below).

Note that if this is uncommented and with empty content,

access will be denied.

#icesecretread=
icesecretwrite=

How many login attempts do we tolerate from one IP

inside a given timeframe before we ban the connection?

Note that this is global (shared between all virtual servers), and that

it counts both successfull and unsuccessfull connection attempts.

Set either Attempts or Timeframe to 0 to disable.

#autobanAttempts = 10
#autobanTimeframe = 120
#autobanTime = 300

Specifies the file Murmur should log to. By default, Murmur

logs to the file ‘murmur.log’. If you leave this field blank

on Unix-like systems, Murmur will force itself into foreground

mode which logs to the console.

#logfile=murmur.log

If set, Murmur will write its process ID to this file

when running in daemon mode (when the -fg flag is not

specified on the command line). Only available on

Unix-like systems.

#pidfile=

The below will be used as defaults for new configured servers.

If you’re just running one server (the default), it’s easier to

configure it here than through D-Bus or Ice.

Welcome message sent to clients when they connect.

welcometext=“
Bienvenue sur le serveur de koshie !
”

Port to bind TCP and UDP sockets to.

port=64738

Specific IP or hostname to bind to.

If this is left blank (default), Murmur will bind to all available addresses.

host=

Password to join server.

serverpassword=

Maximum bandwidth (in bits per second) clients are allowed

to send speech at.

bandwidth=72000

Maximum number of concurrent clients allowed.

users=12

Amount of users with Opus support needed to force Opus usage, in percent.

0 = Always enable Opus, 100 = enable Opus if it’s supported by all clients.

#opusthreshold=100

Maximum depth of channel nesting. Note that some databases like MySQL using

InnoDB will fail when operating on deeply nested channels.

#channelnestinglimit=10

Regular expression used to validate channel names.

(Note that you have to escape backslashes with \ )

#channelname=[ \-=\w\#\[\]\{\}\@\|]+

Regular expression used to validate user names.

(Note that you have to escape backslashes with \ )

#username=[-=\w\[\]\{\}\@\|\.]+

Maximum length of text messages in characters. 0 for no limit.

#textmessagelength=5000

Maximum length of text messages in characters, with image data. 0 for no limit.

#imagemessagelength=131072

Allow clients to use HTML in messages, user comments and channel descriptions?

allowhtml=false

Murmur retains the per-server log entries in an internal database which

allows it to be accessed over D-Bus/ICE.

How many days should such entries be kept?

Set to 0 to keep forever, or -1 to disable logging to the DB.

logdays=14

To enable public server registration, the serverpassword must be blank, and

this must all be filled out.

The password here is used to create a registry for the server name; subsequent

updates will need the same password. Don’t lose your password.

The URL is your own website, and only set the registerHostname for static IP

addresses.

Only uncomment the ‘registerName’ parameter if you wish to give your “Root” channel a custom name.

#registerName=Mumble Server
#registerPassword=secret
#registerUrl=http://mumble.sourceforge.net/
#registerHostname=

If this option is enabled, the server will announce its presence via the

bonjour service discovery protocol. To change the name announced by bonjour

adjust the registerName variable.

See developer.apple.com/networking/b … index.html for more information

about bonjour.

#bonjour=True

If you have a proper SSL certificate, you can provide the filenames here.

Otherwise, Murmur will create it’s own certificate automatically.

#sslCert=
#sslKey=

If Murmur is started as root, which user should it switch to?

This option is ignored if Murmur isn’t started with root privileges.

uname=murmur

If this options is enabled, only clients which have a certificate are allowed

to connect.

#certrequired=False

If enabled, clients are sent information about the servers version and operating

system.

#sendversion=True

You can configure any of the configuration options for Ice here. We recommend

leave the defaults as they are.

Please note that this section has to be last in the configuration file.

[Ice]
Ice.Warn.UnknownProperties=1
Ice.MessageSizeMax=65536

Maintenant, le soucis étant que lorsque je le lance (./murmur.x86 en root, qui exécute avec l’utilisateur murmur que j’ai créer le tout pour des raisons de sécurités) et que je tente de me connecter ça ne marche pas, une autre personne a essayé en vain.

Voici ce que disent les logs:

2013-04-07 20:30:47.210 Initializing settings from /home/murmur/murmur/murmur.ini (basepath /home/murmur/murmur)
2013-04-07 20:30:47.211 Binding to address 0.0.0.0
2013-04-07 20:30:47.211 OpenSSL: OpenSSL 0.9.8o 01 Jun 2010
2013-04-07 20:30:47.211 Successfully switched to uid 1004
2013-04-07 20:30:47.217 ServerDB: Opened SQLite database /home/murmur/murmur/murmur.sqlite
2013-04-07 20:30:47.218 Resource limits were 0 0
2013-04-07 20:30:47.218 Successfully dropped capabilities
2013-04-07 20:30:47.219 OSInfo: Failed to execute lsb_release
2013-04-07 20:30:47.219 Murmur 1.2.4 (1.2.4-rc1-12-gdab8157-ermine) running on X11: Linux 3.2.13-grsec-xxxx-grs-ipv6-64: Booting servers
2013-04-07 20:30:47.354 1 => Server listening on 0.0.0.0:64738
2013-04-07 20:30:47.438 1 => Failed to set IPV6_RECVPKTINFO for 0.0.0.0:64738
2013-04-07 20:30:47.522 1 => Announcing server via bonjour
2013-04-07 20:30:47.606 1 => Not registering server as public
2013-04-07 20:30:47.606 Object::connect: No such slot MurmurDBus::userTextMessage(const User *, const TextMessage &)

Et d’après des gens sur #mumble, mon serveur essaie de pointer sur une IPv6 (même quand je précise explicitement une IPv4). N’ayant pas le besoin et l’envie de me mettre à l’IPv6 je le désactive sur mon serveur de cette façon: wiki.debian.org/DebianIPv6#How_to_turn_off_IPv6

Et ça a été un succès, le banner ssh à ma connexion ne me lance plus mon adresse en IPv6 et un ifconfig donne:

Et comme j’ai redémarré après la manip’, plus d’IPv6 dans mon kernel. J’ai aussi pensé à commenter dans /etc/hosts les lignes concernant l’IPv6.

Pour la variable host j’ai essayé de le laisser vide, de le commenter (conseil sur #mumble), de mettre mon ip, un sous nom de domaine, de mettre 0.0.0.0.

Quand je lance le serveur, voici ce qui est écouté sur le port 64738:

Avez-vous une idée? Je ne sais pas si ce forum est le meilleur endroit pour poser la question mais je désespère un peu.

Cordialement, Koshie

anon96191775 · Février 21, 2016, 2:40pm

Ce n’est clairement pas le cas depuis Squeeze :

dave@HAL9000:~$ apt-cache policy mumble-server mumble-server: Installed: 1.2.3-349-g315b5f5-2.2 Candidate: 1.2.3-349-g315b5f5-2.2 Version table: *** 1.2.3-349-g315b5f5-2.2 0 600 http://ftp.fr.debian.org/debian/ testing/main amd64 Packages 600 http://ftp.fr.debian.org/debian/ unstable/main amd64 Packages 100 /var/lib/dpkg/status 1.2.2-6+squeeze1 0 600 http://ftp.fr.debian.org/debian/ stable/main amd64 Packages 600 http://security.debian.org/ stable/updates/main amd64 Packages

koshie · Février 21, 2016, 2:40pm

La drogue, saimal :

[quote]koshie@Sirius:~$ apt-cache policy mumble-server
mumble-server:
Installé : (aucun)
Candidat : 1.2.3-349-g315b5f5-2.2
Table de version :
1.2.3-349-g315b5f5-2.2 0
500 debian.mirrors.ovh.net/debian/ wheezy/main amd64 Packages
[/quote]

Bien boulet pour le coup… Je testerai avec le paquet ce soir ! Merci.

PascalHambourg · Février 21, 2016, 2:40pm

Rien de plus concret et détaillé concernant ce que tu fais, comment tu le fais, ce que tu attends qu’il se passe et ce qui se passe en réalité, sur le client, sur le serveur, dans les logs de l’un et de l’autre ?

Ah ? De ce que je comprends des logs, murmur ouvre une socket IPv4 en écoute sur l’adresse indéfinie 0.0.0.0 (toutes les adresses IPv4 locales) et le port 64738. Ensuite il essaie d’appliquer à cette socket IPv4 une option qui est manifestement spécifique à IPv6, donc je ne suis pas étonné que cette opération échoue. Il n’en reste pas moins que la sortie de netstat confirme que le port 64738 est bien ouvert en écoute en TCP et UDP pour l’IPv4.

Complètement inutile. C’est comme vouloir supprimer tous les enregistrements DNS IPv6 de l’internet.

koshie · Février 21, 2016, 2:40pm

Bon après installation de mumble-server et de multiple essais, en vain, je reviens vers vous.

J’ai donc /etc/mumble-server.ini qui me permet de configurer le serveur, le voici:

[quote]# Path to database. If blank, will search for

murmur.sqlite in default locations or create it if not found.

database=/var/lib/mumble-server/mumble-server.sqlite

If you wish to use something other than SQLite, you’ll need to set the name

of the database above, and also uncomment the below.

Sticking with SQLite is strongly recommended, as it’s the most well tested

and by far the fastest solution.

#dbDriver=QMYSQL
#dbUsername=
#dbPassword=
#dbHost=
#dbPort=
#dbPrefix=murmur_
#dbOpts=

Murmur defaults to not using D-Bus. If you wish to use dbus, which is one of the

RPC methods available in murmur, please specify so here.

#dbus=system

Alternate service name. Only use if you are running distinct

murmurd processes connected to the same D-Bus daemon.

#dbusservice=net.sourceforge.mumble.murmur

If you want to use ZeroC Ice to communicate with Murmur, you need

to specify the endpoint to use. Since there is no authentication

with ICE, you should only use it if you trust all the users who have

shell access to your machine.

Please see the ICE documentation on how to specify endpoints.

ice=“tcp -h 127.0.0.1 -p 6502”

Ice primarily uses local sockets. This means anyone who has a

user account on your machine can connect to the Ice services.

You can set a plaintext “secret” on the Ice connection, and

any script attempting to access must then have this secret

(as context with name “secret”).

Access is split in read (look only) and write (modify)

operations. Write access always includes read access,

unless read is explicitly denied (see note below).

Note that if this is uncommented and with empty content,

access will be denied.

#icesecretread=
icesecretwrite=

How many login attempts do we tolerate from one IP

inside a given timeframe before we ban the connection?

Note that this is global (shared between all virtual servers), and that

it counts both successfull and unsuccessfull connection attempts.

Set either Attempts or Timeframe to 0 to disable.

#autobanAttempts = 10
#autobanTimeframe = 120
#autobanTime = 300

Murmur default to logging to murmur.log. If you leave this blank,

murmur will log to the console (linux) or through message boxes (win32).

logfile=/var/log/mumble-server/mumble-server.log

If set, murmur will write its process ID to this file.

pidfile=/var/run/mumble-server/mumble-server.pid

The below will be used as defaults for new configured servers.

If you’re just running one server (the default), it’s easier to

configure it here than through D-Bus or Ice.

Welcome message sent to clients when they connect

welcometext=“
Welcome to this server running Murmur.
Enjoy your stay!
”

Port to bind TCP and UDP sockets to

port=64738

Specific IP or hostname to bind to.

If this is left blank (default), murmur will bind to all available addresses.

host=176.31.122.26

Password to join server

serverpassword=

Maximum bandwidth (in bits per second) clients are allowed

to send speech at.

bandwidth=72000

Maximum number of concurrent clients allowed.

users=100

Amount of users with Opus support needed to force Opus usage, in percent.

0 = Always enable Opus, 100 = enable Opus if it’s supported by all clients.

#opusthreshold=100

Regular expression used to validate channel names

(note that you have to escape backslashes with \ )

#channelname=[ \-=\w\#\[\]\{\}\@\|]+

Regular expression used to validate user names

(note that you have to escape backslashes with \ )

#username=[-=\w\[\]\{\}\@\|\.]+

Maximum length of text messages in characters. 0 for no limit.

#textmessagelength=5000

Maximum length of text messages in characters, with image data. 0 for no limit.

#imagemessagelength=131072

Allow clients to use HTML in messages, user comments and channel descriptions?

#allowhtml=true

Murmur retains the per-server log entries in an internal database which

allows it to be accessed over D-Bus/ICE.

How many days should such entries be kept?

Set to 0 to keep forever, or -1 to disable logging to the DB

#logdays=31

To enable public server registration, the serverpassword must be blank, and

this must all be filled out.

The password here is used to create a registry for the server name; subsequent

updates will need the same password. Don’t lose your password.

The URL is your own website, and only set the registerHostname for static IP

addresses.

Only uncomment the ‘registerName’ parameter if you wish to give your “Root” channel a custom name.

#registerName=Mumble Server
#registerPassword=secret
#registerUrl=http://mumble.sourceforge.net/
#registerHostname=

To enable bonjour service discovery uncomment the following line.

To change the name announced by bonjour adjust the registerName variable.

See developer.apple.com/networking/b … index.html for more information

about bonjour.

#bonjour=True

If you have a proper SSL certificate, you can provide the filenames here.

Otherwise, Murmur will create it’s own certificate automatically.

#sslCert=
#sslKey=

If murmur is started as root, which user should it switch to?

This option is ignored if murmur isn’t started with root privileges.

uname=mumble-server

If this options is enabled, only clients which have a certificate are allowed

to connect.

#certrequired=False

If enabled, clients are sent information about the servers version and operating

system.

#sendversion=True

You can configure any of the configuration options for Ice here. We recommend

leave the defaults as they are.

Please note that this section has to be last in the configuration file.

[Ice]
Ice.Warn.UnknownProperties=1
Ice.MessageSizeMax=65536
[/quote]

Ensuite, j’ai essayé de lancer mumble de deux façon:

ou

Dans tout les cas, le serveur écoute bien sur mon IP:

Et netstat -a me dit:

[quote]tcp 0 0 ks395450.kimsufi.:64738 : LISTEN
udp 0 0 ks395450.kimsufi.:64738 : [/quote]

Des erreurs reviennent sans cessent… Voici les logs complètes:

[quote]2013-04-09 20:00:04.698 Initializing settings from /etc/mumble-server.ini (basepath /etc)
2013-04-09 20:00:04.698 Binding to address 176.31.122.26
2013-04-09 20:00:04.699 OpenSSL: OpenSSL 1.0.1e 11 Feb 2013
2013-04-09 20:00:04.699 Successfully switched to uid 110
2013-04-09 20:00:04.736 ServerDB: Opened SQLite database /var/lib/mumble-server/mumble-server.sqlite
2013-04-09 20:00:04.737 Resource limits were 0 0
2013-04-09 20:00:04.737 Successfully dropped capabilities
2013-04-09 20:00:04.738 MurmurIce: Endpoint “tcp -h 127.0.0.1 -p 6502” running
2013-04-09 20:00:04.739 OSInfo: Failed to execute lsb_release
2013-04-09 20:00:04.739 Murmur 1.2.4 (1.2.3-349-g315b5f5-2.2) running on X11: Linux 3.2.13-grsec-xxxx-grs-ipv6-64: Booting servers
2013-04-09 20:00:04.868 1 => Server listening on 176.31.122.26:64738
2013-04-09 20:00:04.952 1 => Failed to set IPV6_RECVPKTINFO for 176.31.122.26:64738
2013-04-09 20:00:05.066 1 => Announcing server via bonjour
2013-04-09 20:00:05.150 1 => Not registering server as public
2013-04-09 20:00:05.150 Object::connect: No such slot MurmurDBus::userTextMessage(const User *, const TextMessage &)
[/quote]

Bah pour se connecter y’a qu’une seule façon, à ma connaissance, via le client Mumble. Et j’attends bien évidemment de me connecter (c’est le but), le client dit:

Donc si je comprend bien il a dépassé le délais avant que le client dise que ça ne marche pas et arrête les tentatives de connexions.

Côté serveur je n’ai qu’un seul fichier de log (ci-dessus) et il n’est pas très verbeux, j’ai pourtant essayé ceci :

Ce qui est censé lancé murmurd en mode verbeux, avec le bon .ini et en foreground, ce n’est pas plus verbeux.

Côté client j’ai cru comprendre que tout était indiqué dans le terminal:

[quote]G15LCDEngineUnix: Unable to connect to G15Daemon.
CELT bitstream 8000000b from libcelt0.so.0.0.0
Locale is fr_FR
Database SQLite: "3.7.13"
Overlay: Removing old socket on "/home/koshie/.MumbleOverlayPipe"
Overlay: Listening on "/home/koshie/.MumbleOverlayPipe"
GlobalShortcutX: Unable to open any keyboard input devices under /dev/input, falling back to XInput
GlobalShortcutX: Using XI2 2.0
SocketRPC: Removing old socket on "/home/koshie/.MumbleSocket"
Plugins: Failed to load libmumble.so: Impossible de charger la bibliothèque /usr/lib/mumble/libmumble.so : (/usr/lib/mumble/libmumble.so: undefined symbol: glPopClientAttrib)
Plugins: Failed to load libmumble.so.1: Impossible de charger la bibliothèque /usr/lib/mumble/libmumble.so.1 : (/usr/lib/mumble/libmumble.so.1: undefined symbol: glPopClientAttrib)
Plugins: Failed to load libmumble.so.1.2: Impossible de charger la bibliothèque /usr/lib/mumble/libmumble.so.1.2 : (/usr/lib/mumble/libmumble.so.1.2: undefined symbol: glPopClientAttrib)
Plugins: Failed to load libmumble.so.1.2.4: Impossible de charger la bibliothèque /usr/lib/mumble/libmumble.so.1.2.4 : (/usr/lib/mumble/libmumble.so.1.2.4: undefined symbol: glPopClientAttrib)
AudioInput: 40000 bits/s, 48000 hz, 480 sample CELT
PulseAudio: Starting input alsa_input.pci-0000_00_1b.0.analog-stereo
PulseAudio: Starting output: alsa_output.pci-0000_00_1b.0.analog-stereo
AudioOutput: Initialized 2 channel 44100 hz mixer
AudioInput: Initialized mixer for 1 channel 48000 hz mic and 0 channel 48000 hz echo
warning: The VAD has been replaced by a hack pending a complete rewrite
OpenSSL Support: 1 (OpenSSL 1.0.1c 10 May 2012) [/quote]

Sachant que le mode débug est activé sur la console.

Ah ? De ce que je comprends des logs, murmur ouvre une socket IPv4 en écoute sur l’adresse indéfinie 0.0.0.0 (toutes les adresses IPv4 locales) et le port 64738. Ensuite il essaie d’appliquer à cette socket IPv4 une option qui est manifestement spécifique à IPv6, donc je ne suis pas étonné que cette opération échoue. Il n’en reste pas moins que la sortie de netstat confirme que le port 64738 est bien ouvert en écoute en TCP et UDP pour l’IPv4.[/quote]

Alors une solution ne serait-elle pas de compiler mumble sans l’IPv6, empêchant l’option d’être utilisé?

Complètement inutile. C’est comme vouloir supprimer tous les enregistrements DNS IPv6 de l’internet.

Pourtant:

You will probably need to comment-out any IPv6 address in /etc/hosts (especially the one for loopback) otherwise ssh will fail to forward ports (or you must always use -4 to ssh).

Source: wiki.debian.org/DebianIPv6#How_to_turn_off_IPv6

Ce n’est donc peut-être pas en rapport avec mon cas mais j’ai préféré le faire vu que c’était proposé, de plus ça fonctionne SSH. Donc j’ai pas à me plaindre, je pense, dans le doute mon /etc/hosts:

[quote]# Do not remove the following line, or various programs

that require network functionality will fail.

127.0.0.1 localhost.localdomain localhost
176.31.122.26 ks395450.kimsufi.com

The following lines are desirable for IPv6 capable hosts

#(added automatically by netbase upgrade)
#::1 ip6-localhost ip6-loopback
#fe00::0 ip6-localnet
#ff00::0 ip6-mcastprefix
#ff02::1 ip6-allnodes
#ff02::2 ip6-allrouters
#ff02::3 ip6-allhosts

D’autres idées?

Koshicalement, Koshie

PascalHambourg · Février 21, 2016, 2:40pm

Un pare-feu qui pourrait bloquer la communication sur ce port ?

koshie · Février 21, 2016, 2:40pm

Si netstat peut écouter dessus c’est que le port n’est pas bloqué, non?

PascalHambourg · Février 21, 2016, 2:41pm

Non, aucun rapport. netstat ne fait que lister les sockets ouvertes et les ports qu’elles utilisent, il ne s’y connecte pas et ne sait pas dire si un pare-feu bloque les communications avec ces sockets.

Ne pas confondre port utilisé par une socket et port autorisé ou bloqué par un pare-feu, ce sont deux choses totalement indépendantes.

Pour afficher le jeu de règles iptables sur la machine, on peut utilise la commande iptables-save en root. Mais il faut vérifier aussi la présence d’un pare-feu sur le poste client et sur tout noeud intermédiaire.

koshie · Février 21, 2016, 2:41pm

Iptables est désactivé et je n’ai pas configuré d’autre pare-feu.

PascalHambourg · Février 21, 2016, 2:41pm

Tu es sûr ? Si l’adresse IP 176.31.122.26 mentionnée dans tes messages est correcte, alors le port 64738 en TCP apparaît filtré, de même que d’autres ports, et non ouvert ou simplement fermé. C’est le signe qu’il y a un pare-feu. Tu as bien vérifié la sortie de la commande iptables-save ?

koshie · Février 21, 2016, 2:41pm

Pour être honnête je ne suis pas (encore) très habitué à iptables, vu son importance faudrait que je m’y mette !

Voici la sortie:

[quote]# Generated by iptables-save v1.4.14 on Sat Apr 13 22:54:05 2013
*raw
:PREROUTING ACCEPT [1002880:728117929]
:OUTPUT ACCEPT [896973:364108684]
COMMIT

Completed on Sat Apr 13 22:54:05 2013

Generated by iptables-save v1.4.14 on Sat Apr 13 22:54:05 2013

*nat
:PREROUTING ACCEPT [33473:6174798]
:INPUT ACCEPT [22404:5590862]
:OUTPUT ACCEPT [88773]
:POSTROUTING ACCEPT [88773]
COMMIT

Completed on Sat Apr 13 22:54:05 2013

Generated by iptables-save v1.4.14 on Sat Apr 13 22:54:05 2013

*mangle
:PREROUTING ACCEPT [1002880:728117929]
:INPUT ACCEPT [1002880:728117929]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [896975:364109140]
:POSTROUTING ACCEPT [897182:364138643]
COMMIT

Completed on Sat Apr 13 22:54:05 2013

Generated by iptables-save v1.4.14 on Sat Apr 13 22:54:05 2013

*filter
:INPUT DROP [11034:582186]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [4:696]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
-A INPUT -j ufw-before-logging-input
-A INPUT -j ufw-before-input
-A INPUT -j ufw-after-input
-A INPUT -j ufw-after-logging-input
-A INPUT -j ufw-reject-input
-A INPUT -j ufw-track-input
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A FORWARD -j ufw-after-forward
-A FORWARD -j ufw-after-logging-forward
-A FORWARD -j ufw-reject-forward
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output
-A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
-A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-before-forward -j ufw-user-forward
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-input -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m state --state INVALID -j ufw-logging-deny
-A ufw-before-input -m state --state INVALID -j DROP
-A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A ufw-before-input -j ufw-not-local
-A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
-A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
-A ufw-before-input -j ufw-user-input
-A ufw-before-output -o lo -j ACCEPT
-A ufw-before-output -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -j ufw-user-output
-A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
-A ufw-logging-deny -m state --state INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
-A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
-A ufw-skip-to-policy-forward -j DROP
-A ufw-skip-to-policy-input -j DROP
-A ufw-skip-to-policy-output -j ACCEPT
-A ufw-track-output -p tcp -m state --state NEW -j ACCEPT
-A ufw-track-output -p udp -m state --state NEW -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 80 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 22 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 4812 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 4812 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 80 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 80 -j ACCEPT
-A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
-A ufw-user-limit-accept -j ACCEPT
COMMIT

Completed on Sat Apr 13 22:54:05 2013

[/quote]

anon96191775 · Février 21, 2016, 2:41pm

Je ne connais rien non plus à iptables, mais ai réussi à le configurer simplement grâce à cet article du Wiki :
isalo.org/wiki.debian-fr/Pa … lifi%C3%A9

Résultat : mon serveur Mumble est accessible depuis l’exterieur

PascalHambourg · Février 21, 2016, 2:41pm

Tiens donc… Pourtant iptables-save affiche un jeu de règles iptables actives long comme un jour sans pain, et des chaînes utilisateur dont le nom laisse penser qu’elles ont été produites par ufw, qui est un “frontal” pour iptables. Dans les règles autorisant les ports en entrée, vers la fin (chaîne ufw-user-input), on ne voit pas celui de mumble en TCP ni en UDP. Tu peux soit configurer ufw pour autoriser ce port, soit ajouter manuellement les règles qui vont bien (mais il faudra le refaire après chaque redémarrage d’ufw).

-A ufw-user-input -p udp -m udp --dport 64738 -j ACCEPT -A ufw-user-input -p tcp -m udp --dport 64738 -j ACCEPT

Note : il y a des doublons dans les ports autorisés en entrée, et les ports UDP ne servent à rien, les protocoles concernées (HTTP, SSH) n’utilisent que TCP.

koshie · Février 21, 2016, 2:45pm

Suite au sujet suivant: besoin-d-aide-a-sa-configuration-t43029.html

Mon problème de mumble est résolu, je vous invite à le consulter si vous avez besoin d’en savoir plus.

Le problème était effectivement iptables.

Merci