Edit iptables to open a port the safest and easiest way (nano?)

Question

I have this web application called HaasBot (running on Mono 5) which I want to run on my Raspberry Pi 3 with Raspbian Stretch Lite (Terminal only!) as a server internally in my network only. Using SSH to do this by the way. The Pi has the OS freshly installed, no other things besides than dirmngr (as I recall correctly) and Mono 5 are installed. Iptables was installed by default. The whole OS is updated and upgraded to it*s latest state of course. The web app can not be considered "installed", because it was just a zip file I extracted, so nothing big there. Also no firewall installed, I also own no hardware firewall. We have a fritzbox and a network-security-server in our business network, where I am connected to. But as said, would need to open the port first anyway since it is required anyway before I can start finding the error with the fritzbox or the network-security-server. My own little network runs closed behind the main network where the fritzbox and the network-security-server is sitting infront of. My Wireless Lan router and the LAN hub (Pi connected by LAN cable of course) are just forwarding the connection to my very own little network.

The application itself is running, it needs the port 8090 and 8092. 8090 seems for incoming connections and 8092 for outgoing connections because when I try to access the web application from another computer's browser by typing in http://192.168.1.202:8090/ it loads my splash page, tries to receive data from the internet but doesn't finish doing so. Current state: Still the web app does not receive any data. It is stuck at the splash page where it says "Connecting to Haasonline Trade Server" Also the web app can only be accessed when typing in "http://192.168.1.202:8090/" in the browser, trying "http://192.168.1.202:8092/" doesn't display the web app

Checking for closed ports with

nmap -p 8092 192.168.1.202

it responds with

PORT: 8092/tcp STATE: closed SERVICE: unknown

Checking it with the port 8090 says the port is opened. Update: As of now it still says the port 8092 is closed. Before I can go and find the error somewhere else I would need to get and keep that port opened anyway first.

I did try Google with several differnt searches and asked here and there, but still no luck getting the port 8092 opened. I only know that if I get it opened and everything works, that I need to enter this command to keep it saved in case I need to reboot my Pi:

iptables-save >/etc/iptable

or to restore the default settings I would need to do this:

iptables-restore </etc/iptables

The command to open the port I already tried was:

sudo iptables -A INPUT -p tcp --dport 8092 -j ACCEPT

and it didn't open the port.

I also was told to run this command to open the port which maybe could help:

iptables -t nat -A PREROUTING -i lo -p tcp -d 127.0.0.1 --dport 8092 -j DNAT --to-destination 192.168.1.202:8092

Update this command also didn't do the trick But now I am getting confused of what is right and what is the wrong command and maybe wanted to get it confirmed here how to do it correctly.

Using the command

netstat -tnlp

responds with 3 lines where I find 1 line containing the internal network IP and the port 8090, it goes as following:

PROTO: tcp RECV-Q: 0 SEND-Q: 0 LOCAL ADDRESS: 192.168.1.202:8090 FOREIGN ADDRESS: 0.0.0.0:* STATE: LISTEN PID/Program name: 608/mono

Could anyone shed some light into this? I honestly do not understand these flags from all these commands and would be more comfortable simply editing a file with

sudo nano

to get this iptables thing right. But if not possible and I really get told the correct command, I would also be fine just pasting it into my ssh command window as a 1 liner-command with several flags that are puzzling me.

Thanks to everyone who could help me out with the correct solution and maybe an ELI5 explanation why the first command did not work.

Thanks again!

PS: Displaying the commands as code doesn't quite work for me here on raspberrypi.stackexchange. Also would love to get help for that! Until then hope you guys still can read it.

Answer 1

The problem got solved by using the following commands:

sudo apt-get install ufw
sudo ufw allow 22
sudo ufw allow 8090
sudo ufw allow 8092
sudo ufw enable
sudo reboot

And everything was just fine. Also there was just also a little issue with the web app's splash page.

I thank everyone for all recommendations and answers! I will upvote what I can! Thanks guys for your time and have a good day!

Answer 2

Chain INPUT (policy ACCEPT)
TARGET: Accept, PROT: tcp, OPT: --, SOURCE: anywhere, DESTINATION: anywhere, tcp dpt: 8092
Chain FORWARD (policy ACCEPT)
Chain OUTPUT (policy ACCEPT)

As per Steve's first comment, your culprit here is not iptables, meaning there is no firewall configured on your Pi. The default in this case is the three lines above starting with "Chain" and a policy of ACCEPT. This applies to any connection not selected by a rule, and it means the connection will be accepted. Since you only have one rule, that applies to just about everything. The rule you do have is actually superfluous, since it also indicates ACCEPT. That's defined on the second line above and is presumably something you did to try and fix things on port 8092. Unless you've added that to a boot script, it will disappear on reboot (but as just explained, it is irrelevant anyway).

Checking it with the port 8090 says the port is opened. Update: As of now it still says the port 8092 is closed.

"Closed" does not mean blocked by a firewall; in that case nmap will say "filtered". However, if you run it from the same machine, you are behind the firewall, so you would just get "closed". But again: You don't have a firewall configured, so this is pretty definitive. The port is closed.

But closed in this context does not mean nothing is using the port. It means nothing is listening on the port. If a port is in use by a listening server, it will be reported as "open". However, if a port is in use by a client application, it will be reported as "closed", since nothing can connect to it. That's the perspective.

8090 seems for incoming connections and 8092 for outgoing connections

Outgoing connections are those of a client to a server. So what you have here doesn't indicate anything is wrong. You can confirm this while the application is running with:

lsof -i TCP:8092

This may be complicated by the fact that it seems unable to make the connection it wants to make. However, the problem is not with the Pi or the operating system. It is within the application or the outside network (e.g, the actual remote host).