Server refuses all connections

[DavidCopperhead]

Hi,
I have strange problem. I've just configured my TS3 server on vServer. Everything looks fine, console returns that it is listening on port 9998 as intended. However whenever I try to connect through the query port or connect to the server, my ts client says that it failed to connect. I have no problem with other servers, all my ports are unlocked. I've tried to connect from the job and home. Other people can't join as well but server says it's running fine... Here is what netstat -an says:

udp 0 0 **x.x.x.x:9998 0.0.0.0:*

** - Where x.x.x.x is my server's IP address.

Here is my console:

2012-03-17 09:10:58.369427|INFO |ServerLibPriv | | TeamSpeak 3 Server 3.0.2 (2012-02-29 05:39:32)
2012-03-17 09:10:58.370161|INFO |DatabaseQuery | | dbPlugin name: SQLite3 plugin, Version 2, (c)TeamSpeak Systems GmbH
2012-03-17 09:10:58.370230|INFO |DatabaseQuery | | dbPlugin version: 3.7.3
2012-03-17 09:10:58.370641|INFO |DatabaseQuery | | checking database integrity (may take a while)
2012-03-17 09:10:58.398355|WARNING |Accounting | | Unable to find valid license key, falling back to limited functionality
2012-03-17 09:10:58.410718|INFO |FileManager | | listening on **x.x.x.x:30033
2012-03-17 09:10:58.446774|INFO |VirtualServer | 1| listening on **x.x.x.x:9998
2012-03-17 09:10:58.446947|INFO |CIDRManager | | updated query_ip_whitelist ips: 127.0.0.1,
2012-03-17 09:10:58.447213|INFO |Query | | listening on **x.x.x.x:10019

** - Where x.x.x.x is my server's IP address.

Hosts.allow and hosts.deny are empty. I don't know how to configurate iptables. Maybe that's the key but as I've read via internet, it allows everyone to connect by default unless you filter it by yourself. I have no clue what to do. I had no problem with configuring other server. But this one just doesn't work. By the way the error with the license doesn't matter. I have the license file but just didn't use it yet, until me or someone figure out what's going on and how to fix my problem.

Can anyone help me with this issue? My vServer provider says that they do not filter anything in my server's network.


P.S: By the way I'm using CentOs 6.0 and obviously my server is detached on screen in the background.

[Barungar]

Have you checked the firewall rules defined on your vps? (check "iptables --list -n")
Have you tried to connect to ts server query from the server itself?

You should not run the server with a detachted screen, you should use the scripts to run the server.
"./ts3server_startscript.sh start" is still the best way to run your server!

[DavidCopperhead]

I figured it out after your post. Got an idea to run setup system and turn off firewall completely. It works now. However I have to setup firewall again soon because it's too dangerous. CentOS always has it's own firewall turned as I've heard. Debian not. That's why it worked on my virtual box (debian) server but didn't on vServer (CentOS).

[Barungar]

Ok, so turn on your firewall again... You need to at one rule for voice (udp 9998), and if you like two other rules for server query and file transfer.

Do a "iptables --list -n" again and look out for your INPUT-Chain.

You need to add the rules there.

For voice you might want to add something like this:
"iptables -I <your input chain> -p udp --dport 9998 -j ACCEPT"

As you might have guessed server query could look like:
"iptables -I <your input chain> -p tcp --dport 10019 -j ACCEPT"

[DavidCopperhead]

This is how it look right now:

iptables --list -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9998
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9998
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:9998
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:9987 state NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:9998 state NEW

Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

[DavidCopperhead]

Ok, here is how it looks right now:

iptables --list -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:9998
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:9998
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:9998
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:9987 state NEW
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:9998 state NEW

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I have no idea how to setup iptables unfortunately. I have read a few topics on this forum and used commands similar to that you said.

[Barungar]

Problem is your rules must be before the deny all rule... everything after "REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited" ist quite useless. you need to delete all your rules.

ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9998
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:9998
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:9998
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:9987 state NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:9998 state NEW

then delete the reject all rule... after that insert your rules again and then re-insert the reject-all rule... viola!

[DavidCopperhead]

Thanks. I'm gonna check that tommorow and I will update this post when I'm done.
It work now. Thanks for advice.