Network tcp/iptables issue with XRDP

From	Henggi <henggi667@gmail.com>
Newsgroups	linux.debian.user
Subject	Network tcp/iptables issue with XRDP
Date	2023-10-24 14:30 +0200
Message-ID	<HsoHM-vVA-29@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi list,

Completely stuck here, any clue appreciated!

Trying to bring up XRDP service on Debian 11-bullsyeye (arm64, incl. backports, fully up-to-date) which is only listening on „lo“ interface (not eth0) even netstat indicates otherwise:
-> incoming tcp syn/ack on localhost interfact (lo) works fine
-> incoming tcp syn/ack on eth0 interface seems not to reach app listening process (while other services on same host are working just fine via the network - so it’s not an „physical" network issue).
-> iptables are cleared and not aware of any other netfilter running… 


---------------------
- XRDP is listening on 3389:

root@server:~# netstat -tulpn |grep -i rdp
tcp        0      0 0.0.0.0:3389            0.0.0.0:*               LISTEN      657/xrdp
tcp6       0      0 127.0.0.1:3350          :::*                    LISTEN      615/xrdp-sesman


---------------------
- using following XRDP pkg versions:

root@server:~# dpkg -l |grep -i rdp
ii  xorgxrdp                           1:0.2.17-1~bpo11+rpt1                 arm64        Remote Desktop Protocol (RDP) modules for X.org
ii  xrdp                               0.9.21.1-1~deb11u1                    arm64        Remote Desktop Protocol (RDP) server

---------------------
- TCP connection test from localhost to interface „lo“ works fine:

root@server:~# nc -zv $(hostname -I) 3389
Connection to 192.168.178.156 3389 port [tcp/ms-wbt-server] succeeded!
root@server:~# nc -zv localhost 3389
Connection to localhost (127.0.0.1) 3389 port [tcp/ms-wbt-server] succeeded!

…these connections also appear in xrdp log
…tcpdump of lo interface (successful) of tcp-syn/ack attached as evidence

---------------------
- When trying same connection test from other host in same LAN it times out (again, other ports/services run just fine - so network itself is not the issue)

client:~ user$ nc -zv 192.168.178.156 3389
nc: connectx to 192.168.178.156 port 3389 (tcp) failed: Operation timed out

…while nothing is logged in xrdp log
...tcpdump of eth0 interface (failed) of tcp-syn (no tcp-ack) attached as evidence

---------------------
- iptables on server are cleared/open (firewalld or other firewall frameworks are not used/installed). Evidence of cleared iptables (nft) and iptables-legacy attached.

---------------------
- tcpdump shows tcp-syn input on „eth0" but never ack’ while tcpdump on „lol“ shows correct syn/ack on tcp connection test (see tcpdump output attached)

---------------------
- Observation on tcp listening behaviour from XRDP configuration in /etc/xrdp/xrdp.ini (file attached)
— by default xrdp.ini listening config is set to "port=3389“ (which is expected to listen on ipv4 && ipv6 in parallel as I understand). However using that seems only to listen on tcp4 according to „netstat“
— therefore changed listening config to "port=tcp://:3389“ (which is exprected to listen on ip4/tcp only)… which seems todo that as per netstat output shown above
—> This isn’t necessarily an issue but since my issue is related to the listening on network interface I thought it’s worth to point-out this observation.


Thanks for any clue!

Best,
Henggi

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Network tcp/iptables issue with XRDP Henggi <henggi667@gmail.com> - 2023-10-24 14:30 +0200
  Re: Network tcp/iptables issue with XRDP Dan Ritter <dsr@randomstring.org> - 2023-10-24 15:10 +0200
    Re: Network tcp/iptables issue with XRDP Henggi <henggi667@gmail.com> - 2023-10-24 15:30 +0200
      Re: Network tcp/iptables issue with XRDP Dan Ritter <dsr@randomstring.org> - 2023-10-24 15:40 +0200
        Re: Network tcp/iptables issue with XRDP Henggi <henggi667@gmail.com> - 2023-10-24 16:10 +0200
  Re: Network tcp/iptables issue with XRDP Arno Lehmann <al@its-lehmann.de> - 2023-10-24 15:40 +0200
    Re: Network tcp/iptables issue with XRDP Henggi <henggi667@me.com> - 2023-10-24 16:50 +0200
      Re: Network tcp/iptables issue with XRDP Arno Lehmann <al@its-lehmann.de> - 2023-10-24 17:50 +0200
        Re: Network tcp/iptables issue with XRDP Henggi <henggi667@gmail.com> - 2023-10-24 18:40 +0200
          Re: Network tcp/iptables issue with XRDP Anssi Saari <anssi.saari@debian-user.mail.kapsi.fi> - 2023-10-25 10:40 +0200
    Re: Network tcp/iptables issue with XRDP Charles Curley <charlescurley@charlescurley.com> - 2023-10-24 17:30 +0200
      Re: Network tcp/iptables issue with XRDP Henggi <henggi667@gmail.com> - 2023-10-24 17:50 +0200
  Re: Network tcp/iptables issue with XRDP Max Nikulin <manikulin@gmail.com> - 2023-10-24 16:40 +0200
    Re: Network tcp/iptables issue with XRDP Henggi <henggi667@gmail.com> - 2023-10-24 18:20 +0200

csiph-web