Which ports open for Nixstats?

webcraft

Hello,
I just tried to setup nixstats, so far so good but when I reapplied my firewall rules it stopped working and didn't update for an hour now. Which ports do I need to open in my firewall to make it running?

Thanks.

nfn

I think you need to open outgoing connections to https

webcraft

@nfn said:
I think you need to open outgoing connections to https

So port 443? I'm using ubuntu iptables.

lamron

If you see DROP policy for outgoing connections you need to open port 443 for OUTPUT with iptables.

iptables -A OUTPUT -p tcp --sport 443 -m state --state NEW -j ACCEPT

iptables -A OUTPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

In most cases it makes little sense to restrict OUTPUT to DROP because it involves a lot of rules to allow outgoing traffic for all you host. However if you like super restrictive systems you can keep DROP on all chains but be ready to invest a lot of time in setup up your firewall of every new application you host.

webcraft

@lamron said:
If you see DROP policy for outgoing connections you need to open port 443 for OUTPUT with iptables.

iptables -A OUTPUT -p tcp --sport 443 -m state --state NEW -j ACCEPT

iptables -A OUTPUT -p tcp --dport 443 -m state --state NEW -j ACCEPT

In most cases it makes little sense to restrict OUTPUT to DROP because it involves a lot of rules to allow outgoing traffic for all you host. However if you like super restrictive systems you can keep DROP on all chains but be ready to invest a lot of time in setup up your firewall of every new application you host.

I just drop incoming and forwarding. Outgoing is accepted.

sin

webcraft said: I just drop incoming and forwarding. Outgoing is accepted.

You're fine then...I allow outgoing and block incoming with only ports 22, 80, 443 open - NixStats works fine.

lamron

@webcraft have you added rules that allow replies to established outgoing connections?

MikePT

@vfuse

webcraft

@lamron said:
webcraft have you added rules that allow replies to established outgoing connections?

That was the hint. I disabled it because of GameServers I think. Now it's working fine. Thank you!

vfuse

The agent just needs port 443 (https) to api.nixstats.com.

lamron

Glad I could help you. You really shouldn't block replies by already established outgoing connections. This will only bring problems because you cannot receive replies to any of your going requests (DNS, ping and etc...). Bad idea.