Wieso kann ich meinen SVN-server nicht von ausserhalb erreichen?

Vserver mit Firewall kann nicht von aussen auf port 3690 angesprochen werden. Wie kommt das?

Hallo, Administratoren.

Ich richte gerade einen VServer (Debian Lenny) ein. Auf diesem habe ich Subversion installiert, die svnserve.conf meinen beduerfnissen angepasst und der dienst funktioniert soweit auch, jedoch nur, wenn ich ihn vom server aus ueber localhost anspreche.
Auf dem Server laufen iptables. Ich habe versucht mit dem Command "iptables -A INPUT -m state --state NEW -m tcp -p tcp -dport 3690 -j ACCEPT" den noetigen ACCEPT-eintrag hinzuzufuegen. Leider ohne erfolg.
Ebenfalls habe ich versucht per telnet auf pot 3690 zu verbinden, was per localhost auch klappt, jedoch wieder nicht von aussen, deswegen gehe ich stark davon aus, dass die IPtables den zugriff, den ich brauche einschraenken.
Meine IPtables sehen so aus:

[code]
Chain INPUT (policy DROP)
target prot opt source destination
fail2ban-ssh tcp -- anywhere anywhere multiport dports ssh
LOG all -- anywhere anywhere state INVALID limit: avg 2/sec burst 5 LOG level warning prefix `INPUT INVALID '
DROP all -- anywhere anywhere state INVALID
MY_DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
MY_DROP tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN
MY_DROP tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST
MY_DROP tcp -- anywhere anywhere tcp flags:FIN,RST/FIN,RST
MY_DROP tcp -- anywhere anywhere tcp flags:FIN,ACK/FIN
MY_DROP tcp -- anywhere anywhere tcp flags:PSH,ACK/PSH
MY_DROP tcp -- anywhere anywhere tcp flags:ACK,URG/URG
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp source-quench
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
ACCEPT icmp -- anywhere anywhere icmp parameter-problem
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:www
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssmtp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:pop3
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:pop3s
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:imap2
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:imaps
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:nntp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:domain
ACCEPT udp -- anywhere anywhere state NEW udp dpt:domain
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ftp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:mysql
ACCEPT udp -- anywhere anywhere state NEW udp dpt:ntp
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:6060
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ircd
MY_REJECT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:svn
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:3980

Chain FORWARD (policy DROP)
target prot opt source destination

Chain OUTPUT (policy DROP)
target prot opt source destination
LOG all -- anywhere anywhere state INVALID limit: avg 2/sec burst 5 LOG level warning prefix `OUTPUT INVALID '
DROP all -- anywhere anywhere state INVALID
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp echo-request
MY_REJECT all -- anywhere anywhere

Chain MY_DROP (7 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 2/sec burst 5 LOG level warning prefix `PORTSCAN DROP '
DROP all -- anywhere anywhere

Chain MY_REJECT (2 references)
target prot opt source destination
LOG tcp -- anywhere anywhere limit: avg 2/sec burst 5 LOG level warning prefix `REJECT TCP '
REJECT tcp -- anywhere anywhere reject-with tcp-reset
LOG udp -- anywhere anywhere limit: avg 2/sec burst 5 LOG level warning prefix `REJECT UDP '
REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable
LOG icmp -- anywhere anywhere limit: avg 2/sec burst 5 LOG level warning prefix `DROP ICMP '
DROP icmp -- anywhere anywhere
LOG all -- anywhere anywhere limit: avg 2/sec burst 5 LOG level warning prefix `REJECT OTHER '
REJECT all -- anywhere anywhere reject-with icmp-proto-unreachable

Chain fail2ban-ssh (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
[/code]

Hier noch meine svnserve.conf, an der duerfte aber eigentlich alles passen, da ich einen zweiten rechner habe, der mit der identischen config am netz haengt und funktioniert.

[code]
### This file controls the configuration of the svnserve daemon, if you
### use it to allow access to this repository. (If you only allow
### access through http: and/or file: URLs, then this file is
### irrelevant.)

### Visit http://subversion.tigris.org/ for more information.

[general]
### These options control access to the repository for unauthenticated
### and authenticated users. Valid values are "write", "read",
### and "none". The sample settings below are the defaults.

1. anon-access = read

auth-access = write
### The password-db option controls the location of the password
### database file. Unless you specify a path starting with a /,
### the file's location is relative to the directory containing
### this configuration file.
### If SASL is enabled (see below), this file will NOT be used.
### Uncomment the line below to use the default password file.
password-db = passwd
### The authz-db option controls the location of the authorization
### rules for path-based access control. Unless you specify a path
### starting with a /, the file's location is relative to the the
### directory containing this file. If you don't specify an
### authz-db, no path-based access control is done.
### Uncomment the line below to use the default authorization file.

1. authz-db = authz

### This option specifies the authentication realm of the repository.
### If two repositories have the same authentication realm, they should
### have the same password database, and vice versa. The default realm
### is repository's uuid.

1. realm = My First Repository

grindhold = write
zigapeda = write
chefkoch = write
aniras = write
kevin = write


[sasl]
### This option specifies whether you want to use the Cyrus SASL
### library for authentication. Default is false.
### This section will be ignored if svnserve is not built with Cyrus
### SASL support; to check, run 'svnserve --version' and look for a line
### reading 'Cyrus SASL authentication is available.'

1. use-sasl = true

### These options specify the desired strength of the security layer
### that you want SASL to provide. 0 means no encryption, 1 means
### integrity-checking only, values larger than 1 are correlated
### to the effective key length for encryption (e.g. 128 means 128-bit
### encryption). The values below are the defaults.

1. min-encryption = 0
2. max-encryption = 256

[/code]

Kann mein problem auch noch andere ursachen als iptables haben?
Auf dem Server lauffen ausserdem noch;
Apache2
fail2ban
MySQL
chkrootkit

Wenn IP-Tables: Kann ich diese irgendwie deaktivieren? Beim googeln fand ich einen hinweis drauf, dass es die moeglichkeit gibt per /etc/init.d/iptables stop diese auszuschalten, jedoch existiert dieser daemon in meinem system nicht.

In diesem Sinne schonmal danke an euch alle


grindhold

MY_REJECT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:svn
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:3980 

iptables -N ext-in
iptables -N avd-in-check
iptables -N icmp-ext
ipables -P INPUT DROP
iptables -A INPUT -i eth0 -d 1.2.3.4 -j ext-in
iptables -A INPUT -p icmp -j icmp-ext
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptabkes -A ext-in -p tcp --dport 3690 -m state --state NEW,ESTABLISHED -j adv-in-check
iptables -A ext-in -p udp --dport 3690 -m state --state RELATED,ESTABLISHED -j adv-in-check
iptables -A ext-in -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j adv-in-check
iptables -A adv-in-check -m state --state NEW -j LOG --log-prefix "NEW-CON: "  
... weitere erweiterte Prüfungen für eingehende Verbindungen, z.B. L7, ascii usw..
... jede regel enthält ein explizites ACCEPT. Alles andere wird verworfen.
iptables -A icmp-ext -i eth0 -p icmp --icmp-type echo-rewuest -j ACCEPT

und ausgehend das selbe

iptables -N ext-out
iptables -A OUTPUT -o eth0 -s 1.2.3.4 -j ext-out
iptables -A OURPUT -p icmp -j icmp-ext
iptables -A ext-out -p tcp --sport 3690 -m state --state ESTABLISHED -j adv-out-check
iptables -A adv-out-check -m owner --uid-owner svn -j ACCEPT
iptables -A ext-out -p udp --sport 3690 -m state --state ESTABLISHED,RELATED -j adv-out-check