Imagine that a friend is trying to connect to one of your services and he mention that when he tries to connect, finally displays a “(tcp) failed: Connection timed out”
The first thing, I go and check if I could connect to the service, then I’ll check if the service is working properly, if it’s right, I will go and check the firewall…..
Wow, I have all open in iptables, everybody could connect to that service, but I need to deal with my friend and tell him something! Because he told me, that he doesn’t have any rule that could block the connections.
First of all, I’m going to try to simulate this problem.
I open the port listening in X ip.
nc -l 127.0.0.2 3000
Then I start sniffing:
tcpdump -vvv -s0 -i lo -w lo.pcap
With netcat I also try to connect to the service:
nc -v -z 127.0.0.2 3000
nc: connect to 127.0.0.2 port 3000 (tcp) failed: Connection timed out
And now I open the .pcap with wireshark.
127.0.0.1 is my FRIENDS IP and 127.0.0.2 is the service in port 3000.
Here we could see, how my FRIEND/CLIENT send me a SYN, but when I answer with the SYN,ACK the client send me a retransmission of the SYN, and here it’s where the loop starts, because I also have to send him again a SYN,ACK.
The first thing that I think: the origin is blocking the incoming SYN,ACK
So I ask my friend for the RULES, and here they are: