Forums

Resolved
0 votes
I have a device that needs to have TCP ports 80 and 443 open. How do open them? My ClearOS 6 is set for Gateway. None of my Windows apps have a problem reaching the internet but this device...it's Pitney Bowes Smartlink, can get a ip from the DHCP server on my wireless router (Linksys WRT3200ACM) and shows up on the network but can't get out to get configured by the Pitney Bowes server. Their trouble shooting says the ports it needs are being blocked.
Tuesday, January 08 2019, 03:08 AM
Share this post:

Accepted Answer

Friday, January 18 2019, 08:35 AM - #Permalink
Resolved
0 votes
Actually the set up of the Linksys looks wrong as you've given it a WAN IP of 192.168.1.60 and Gateway as 192.168.1.4, then you've put its LAN on the same subnet. This cannot work. You say you are not connecting to the WAN port, so remove the WAN IP setting.

This may cause a problem as it may not allow you to set a default gateway (needed for the DHCP server) without setting a WAN IP.

Really it would be easiest to use ClearOS as the DHCP server as you may struggle with the configuration options in the Linksys.
The reply is currently minimized Show
Responses (9)
  • Accepted Answer

    Monday, January 28 2019, 01:47 AM - #Permalink
    Resolved
    0 votes
    So as suggested I turned off the DHCP on the Linksys Router and set up DHCP on the ClearOS box and now the Smartlink can get connected and is working properly. So whatever conflicts were happening they are fixed. I didn't change the ip address of the Linksys box though it's still 192.168.1.60 and the ClearOS Gateway still has the ip address of 192.168.1.4 that's the address I enabled the DHCP on in the DHCP app. I left the 2nd ethernet controller as disabled for DHCP, it's the one that goes to the ISP router and has the public IP address. But it's all fine now.


    Thanks
    The reply is currently minimized Show
  • Accepted Answer

    Friday, January 18 2019, 08:29 AM - #Permalink
    Resolved
    0 votes
    I've tidied up your post putting your output between code tags rather than quote tags. I've also had to remove all the line breaks which appeared. Thinking about it, it may be better to pipe the commands to a file so the line breaks do not appear.

    The firewall is pretty much default and is not blocking any outbound traffic, so not stopping the Smartlink from contacting the internet, so the problem is probably elsewhere.

    Can you ping 192.168.1.181 from ClearOS?
    Is the Smartlink connecting to the main wireless network or guest network?

    If you use ClearOS as the DNS server for the rest of your LAN, can I suggest you put it's LAN IP in the DHCP server section of the Linksys rather than the two external IP's you have at the moment.
    The reply is currently minimized Show
  • Accepted Answer

    Thursday, January 17 2019, 11:07 PM - #Permalink
    Resolved
    0 votes
    Sorry I've been out of pocket lately. Here are the output of those commands requested.



    [root@dtech ~]# iptables -nvL
    Chain INPUT (policy DROP 132 packets, 38536 bytes)
    pkts bytes target prot opt in out source destination
    0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
    0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x12/0x12 state NEW reject-with tcp-reset
    0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW
    0 0 DROP all -- eth0 * 127.0.0.0/8 0.0.0.0/0
    0 0 DROP all -- eth0 * 169.254.0.0/16 0.0.0.0/0
    48 5429 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
    0 0 ACCEPT all -- pptp+ * 0.0.0.0/0 0.0.0.0/0
    0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0
    645 135K ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0
    6 174 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmp type 0
    0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmp type 3
    7 308 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmp type 8
    0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmp type 11
    0 0 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
    0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp spt:67 dpt:68
    0 0 ACCEPT tcp -- * * 0.0.0.0/0 66.64.45.243 tcp dpt:22
    0 0 ACCEPT tcp -- * * 0.0.0.0/0 66.64.45.243 tcp dpt:81
    3 618 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpts:1024:65535 state RELATED,ESTABLISHED
    0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535 state RELATED,ESTABLISHED

    Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts bytes target prot opt in out source destination
    43755 32M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
    1150 67590 ACCEPT all -- eth1 * 0.0.0.0/0 0.0.0.0/0
    0 0 ACCEPT all -- pptp+ * 0.0.0.0/0 0.0.0.0/0
    0 0 ACCEPT all -- tun+ * 0.0.0.0/0 0.0.0.0/0

    Chain OUTPUT (policy DROP 0 packets, 0 bytes)
    pkts bytes target prot opt in out source destination
    48 5429 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
    0 0 ACCEPT all -- * pptp+ 0.0.0.0/0 0.0.0.0/0
    0 0 ACCEPT all -- * tun+ 0.0.0.0/0 0.0.0.0/0
    539 52685 ACCEPT all -- * eth1 0.0.0.0/0 0.0.0.0/0
    13 482 ACCEPT icmp -- * eth0 0.0.0.0/0 0.0.0.0/0
    0 0 ACCEPT udp -- * eth0 0.0.0.0/0 0.0.0.0/0 udp spt:68 dpt:67
    0 0 ACCEPT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0 tcp spt:68 dpt:67
    0 0 ACCEPT tcp -- * eth0 66.64.45.243 0.0.0.0/0 tcp spt:22
    0 0 ACCEPT tcp -- * eth0 66.64.45.243 0.0.0.0/0 tcp spt:81
    3 210 ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0

    Chain DROP-lan (0 references)
    pkts bytes target prot opt in out source destination
    0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0


    And


    [root@dtech ~]# iptables -nvL -t nat
    Chain PREROUTING (policy ACCEPT 1807 packets, 110K bytes)
    pkts bytes target prot opt in out source destination

    Chain POSTROUTING (policy ACCEPT 19 packets, 1306 bytes)
    pkts bytes target prot opt in out source destination
    0 0 ACCEPT all -- * tun+ 0.0.0.0/0 0.0.0.0/0
    1646 95519 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0


    Chain OUTPUT (policy ACCEPT 40 packets, 2393 bytes)
    pkts bytes target prot opt in out source destination
    The reply is currently minimized Show
  • Accepted Answer

    Wednesday, January 09 2019, 08:40 AM - #Permalink
    Resolved
    0 votes
    Your first couple of posts get moderated, so don't appear immediately. I can delete one, but I'm not sure which as they are similar but different.

    Is the ClearOS LAN 192.168.1.4?
    I guess for these settings to appear that you have not put the router in Bridge Mode. In that case, is there an option to isolate the Wireless LAN form the Wired LAN? If there is, you will need to disable it.
    Can you ping 192.168.1.181 from ClearOS?

    [edit]
    Have you tried a wired connection?
    What is the output to:

    iptables -nvL
    iptables -nvL -t nat
    Between "code" tags, please.
    [/edit]
    The reply is currently minimized Show
  • Accepted Answer

    Wednesday, January 09 2019, 03:23 AM - #Permalink
    Resolved
    0 votes
    You would do better to use the dhcp server on your clearos box for your lan and disable the one on your Cisco router. Your cos firewall works in conjunction with dnsmasq (aka dhcp server) on your gateway. That's the beauty of using it as a gateway. I would try that first.
    The reply is currently minimized Show
  • Accepted Answer

    Tuesday, January 08 2019, 08:04 PM - #Permalink
    Resolved
    0 votes
    OK sorry I've replied twice, I didn't see the first reply and redid it. Hope this helps.
    The reply is currently minimized Show
  • Accepted Answer

    Tuesday, January 08 2019, 08:01 PM - #Permalink
    Resolved
    0 votes
    Network Configuration:

    The ClearOS serves as the Gateway for my Microsoft Peer Network. Everything has a fixed ip address and there is no DHCP server on the network. As you guessed I do not connect the Linksys Wireless Router with the WAN port I connect it to the Network Switch (it's not programmable) through one of the available ethernet ports, and until I tried to add this SmartLink to the system I had turned off DHCP on the Linksys. The ClearOS box is connected of course to the Network switch with one of it's network interfaces, while the 2nd network interface goes to the internet modem provided by my ISP. Both interfaces on the ClearOS box have static ip addresses (one public and one private of course).

    The Smartlink can be used either wired or wireless. Because of location I decided to go with the wireless option. Both options required a DHCP server, so I enabled that on the Linksys. It did issue a ip for the device and I was able to determine what that ip was using their network map widget. I can ping the Smartlink, so it did get an ip from the DHCP on the Linksys.

    Watching the blinking colors leads me to this error code.

    Connecting to server

    The device is unable to connect through your network.

    The ports that SmartLinkTM uses to connect to the internet are being blocked by your network firewall. The SmartLinkTM device will connect with port 31314, 993, or 443 using TCP. Please verify your network allows traffic through these ports. The SmartLink device will also get upgrades with port 80 using TCP. Please allow this port as well.
    The URL that the SmartLinkTM uses to connect to the internet is being blocked by your network firewall. The SmartLinkTM device connects to the address agent.sl.pb.com. Please make sure this is allowed through your firewall.

    ____________________________

    I've attached a couple of screen shots about the Linksys and Network
    The reply is currently minimized Show
  • Accepted Answer

    Tuesday, January 08 2019, 06:46 PM - #Permalink
    Resolved
    0 votes
    I do not use the WAN port on the Linksys, it's connected to the network switch with one of it's ethernet ports. I did turn off DHCP and I gave it a fixed ip address as all of my devices (printers and workstations) have fixed ip address. Have never used a DHCP server on the network. The Clear OS has 2 network interfaces one is also connected to the Network (dumb) Switch, the other is the gateway to internet router provided by my ISP.

    The Smartlink only works if there is a DHCP server, so I selected to set it up for wireless and turned on the DHCP on the Linksys. It did issue a ip address and I can ping that address. The linksys has a widget that shows your network and this device shows up on the network map, the widget allows you to view the whole network and I could identify the Smartlink by it's MAC address. It just can't get to the internet. Looking at the lights on the device for errors this is the error code.

    Connecting to server
    The device is unable to connect through your network.

    The ports that SmartLinkTM uses to connect to the internet are being blocked by your network firewall. The SmartLinkTM device will connect with port 31314, 993, or 443 using TCP. Please verify your network allows traffic through these ports. The SmartLink device will also get upgrades with port 80 using TCP. Please allow this port as well.

    The URL that the SmartLinkTM uses to connect to the internet is being blocked by your network firewall. The SmartLinkTM device connects to the address agent.sl.pb.com. Please make sure this is allowed through your firewall.


    Every other device on that map can get to the internet. So I'm not sure why the Smartlink can't get through the Gateway. I assumed that the ports weren't available.
    The reply is currently minimized Show
  • Accepted Answer

    Tuesday, January 08 2019, 08:30 AM - #Permalink
    Resolved
    0 votes
    I am not sure of your set up at all. From a quick read, the Pitney Bowes Smartlink only needs outbound access to ports 80 and 443. This is allowed by default in ClearOS unless the IDS/IPS or DNSThingy is getting in the way.

    If it is getting its IP address from the Linksys, how do you have the Linksys connected? Typically you would not use its WAN port, turn off its DHCP server and give it an IP address on the ClearOS LAN so anything connected to it uses the ClearOS DHCP server. You would then connect the ClearOS LAN to the Linksys LAN. It may support bridge mode, in which case its WAN port becomes another LAN port.

    It sounds like you have connected the Linksys WAN to your LAN so the Smartlink gets double-natted and all WiFi devices get a single IP as far as ClearOS is concerned (the Linksys WAN IP). In this case it is important the Linksys and ClearOS LANs are on different subnets. This should not be a problem either for the Smartlink.

    How is your network configured?
    The reply is currently minimized Show
Your Reply