Linux Iptables open Bittorrent tcp ports 6881 to 6889

in Categories CentOS, Debian Linux, Howto, Iptables, Linux, Linux desktop, Networking, RedHat/Fedora Linux, Security, Shell scripting, Suse Linux, Ubuntu Linux last updated December 8, 2005

I already wrote about Linux command line bittorrent client. However, I received few more queries regarding firewall issues. Basically you need to open ports using iptables.

Bittorrent client by default uses tcp 6881 to 6889 ports only. In order to work with Bittorrent client you need to open these ports on firewall. Remember, if you are behind a firewall (hardware or software) you need to enable port forwarding to internal systems.

Scenario # 1: Windows or Linux desktop behind router firewall

Internet ->     Hardware Router    -> Your Linux Desktop
          with port forwarding          Client
              enabled

You have router (ADSL/DSL/Cable modem+router) and you have already enabled port forwarding on router (open web browser > Open router web admin interface > Find port forwarding > Enable port forwarding for bittorent protocol). You also need to open port using following iptables rules on Linux desktop (open TCP port 6881 to 6999):

iptables -A INPUT -p tcp --destination-port 6881:6999 -j ACCEPT
iptables -A OUTPUT -p tcp --source-port 6881:6999 -j ACCEPT

Here is a complete sample firewall script:

#!/bin/sh
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
modprobe ip_conntrack
modprobe ip_conntrack_ftp

# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT

# Unlimited access to loop back
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow UDP, DNS and Passive FTP
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

#allow bittorent incomming client request
iptables -A INPUT -p tcp --destination-port 6881:6999 -j ACCEPT

#Uncomment below to allow sshd incoming client request
#iptables -A INPUT -p tcp -dport 22 -j ACCEPT

# DROP everything and Log it
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

Scenario # 2

Internet -> Linux computer Router  ->  Your Linux Desktop
         with port forwarding      OR Windows XP client
         enabled using IPTABLES       IP:192.168.1.2
           IP:192.168.1.254

Here you are using a Linux as software firewall and iptables as your NAT (firewall) for internal network (192.168.1.2). You need to enable port forwarding to a internal Linux desktop (may be Windows XP desktop) for BitTorrent client system. Add following two line of code to your existing NAT firewall script.

iptables -t nat -A PREROUTING -p tcp --dport 6881:6889
-j DNAT --to-destination 192.168.1.2

iptables -A FORWARD -s 192.168.1.2 -p tcp --dport 6881:6889
-j ACCEPT

Related: Linux Command line BitTorrent client

How do I synchronise my single Debian Linux desktop clock to network?

in Categories Debian Linux, Howto, Linux, Ubuntu Linux last updated October 22, 2005

You will find lots of tutorials about how to setup NTP server. However if you just wanna synchronize single Linux desktop connected via A/DSL Internet connection use ntpdate command. It is very easy to configure and install ntp client. Following instructions are only compatible with Debian / Ubuntu Linux.

ntpdate client

ntpdate sets the local date and time by polling the Network Time Protocol (NTP) server(s) given as the server arguments to determine the correct time. It must be run as root on the local host. A number of samples are obtained from each of the servers specified and a subset of the NTP clock filter and selection algorithms are applied to select the best of these. Note that the accuracy and reliability of ntpdate depends on the number of servers, the number of polls each time it is run and the interval between runs.

Install ntpdate utility

ntpdate command sets the local date and time by polling the Network Time Protocol (NTP) server(s).

# apt-get install ntpdate

You are done by default /etc/default/ntpdate file is use to point pool.ntp.org server .

Allow access to NTP client via Iptables firewall

NTP client uses the udp port 123 to communicate with NTP server. Following rule opens/allows NTP client outgoing request:

# NTP outgoing client request
iptables -A output -p udp -s 192.168.1.1 --sport 1024:65535 -d 0/0  --dport 123 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A input -p udp -s 0/0 --sport 123 -d 192.168.1.1  --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT

Add above rules to your existing iptables script. Please note if you have more than 2-3 computers, then it is better idea to setup your own NTP server. I will write on ntpserver configuration later on.

For more information visit public ntp time server for everyone NTP pool website and read ntpdate man page.