Iptables/ServerSockets problem

Question

hello all,
I've also put this post in the java programming forum as I didn't know which was more appropriate, sorry for duplication if you've read it elsewhere...
I am having a problem getting iptables to accept an incoming port connection from java. I have a java program that creates a ServerSocket as follows:
public NetworkServer()
try
InetAddress addr = java.net.InetAddress.getByName("localhost");
server = new ServerSocket(1050,0,addr);
System.out.println("server = " + server);
System.out.println("connection successful");
catch(Exception ioe)
System.out.println("error connecting to port 1050 : " + ioe);
I have set up iptables with the following commands to let allow this connection through:
iptables -P INPUT DROP
iptables -A INPUT -d localhost -p tcp --dport 1050 -j ACCEPT
iptables -A INPUT -d localhost -p tcp --sport 1050 -j ACCEPT
the forward and output tables have default accept policies with no other governing rules.
The outcome of this is that the ServerSocket tries to connect to the address from InetAddress.getByName, which is retrieved as "localhost/127.0.0.1", and after 3 mins with the following output:
server=[addr=localhost/127.0.0.1,port=0,localport=1050]
I saw a previous post on this forum regarding iptables stating that packets are dropped after 3 minutes if no reply is received. But if this is true and this is what is happening, I don't see why the socket is being set up? No exception occurs.
As the "port" number is 0, I tried adding entries in iptables for 0 also, but this doesn't make any difference. I understand that ServerSockets may make connections on different ports to clients, but the output says that it has (tried to) set up a connection on port 1050.....
I was thinking it may have a problem with the inet address, as it has both the name and IP address of the localhost, and maybe iptables just needs one of these as an input parameter? However an InetAddress can only be constructed from one of the native methods provided so has to be in this format.
any ideas gratefully appreciated, I am completely flummoxed!!!

Answer 1

hi, thanks for the info....
I needed to block all input on the localhost for testing purposes as I only had 1 pc for both client and server applications. I've now realised this won't work as the localhost needs certain things running on certain ports so I can't block too much - my java editor wouldn't even run!
I am in the middle of setting up a network so I can block access to stuff from external IP addresses. Hopefully this should work a bit better :)
cheers,
Bec.