Question How to troubleshoot blocked ports

[weslee91]

I am trying to open some ports for a server to run from my PC - however it appears that all non-standard ports are being blocked.
The host machine is running windows 11, I am testing with a basic python http server using the intended ports.
-------------------------------------------------------------------

I have added an inbound rule to windows firewall to accept the port, tested it is set via "netsh firewall show state" and get this output;
Ports currently open on all network interfaces:
Port Protocol Version Program
43594 TCP Any (null)
-------------------------------------------------------------------

I can also see the server is listening on the port via "netstat -ano" showing this output;
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:43594 0.0.0.0:0 LISTENING 21488
-------------------------------------------------------------------

Which confirms the process is the python server with "tasklist|findstr "21488"";
python3.11.exe 21488 Console 1 26,204 K
-------------------------------------------------------------------

I've had a look at the other threads here, here's some common issues I've been able to rule out;

I have a public IP
The port is forwarding to the correct lan address in my router config
The server is up and running while testing
The server is accessible via lan (other devices on the lan can connect to it via lan address) using the ports in question
-------------------------------------------------------------------

I'm also hosting a Plex Media server and an apache web server from a raspberry pi on my network, both of these are working and accessible via open ports (80 and 11650)

Does anyone have any ideas on what might be blocking my ports from opening correctly?
Or any way I could try narrow down if the source of the issue is my router or host device? (note that trying to run the python server via the raspberry pi still doesn't work, so I'm leaning more towards the problem being the router config somewhere)

 

[bill001g]

I am somewhat confused as to what exact device you are using for what.

You have a server running on unix based machine and you are accessing it with a windows machine ? I will assume these are actual machines and not some VM stuff ?

The first fairly standard thing to try is to use the DMZ option rather than port forwarding. This tends to be much simpler so it is not as easily affected by strange mis configured option or maybe some firmware bug in the router.

Next are you trying to test from the windows machine on the same lan as your server BUT you are using the external wan ip. This requires special support in a router commonly called hairpin. Even if the router has this feature it is generally not documented.
You really want to test from a device that is actually remote on the internet. Maybe run the client machine using a vpn so that the traffic really comes from the internet.

After this it is hard to say what to try next. It has been a long time since I have done a packet capture on linux machine. I think it is a tcpdump command. Pretty much what you are looking to see is do you even get the packets and if you do does the machine respond. The packet capture happens before any kind of filter or firewall so you will see the packets even if they get blocked. If you do receive them then it is a server issue.

 

[ajohnson30]

One thing you could do if you need a packet capture on the linux side is to install/run tshark, which is available on pretty much all distros. Run a short capture, then use something like Filezilla to grab the capture output file over to your windows box and view it in Wireshark for easy decoding. You should be able to see traffic to/from any give ip address and what port it was on.

 

[weslee91]

I am somewhat confused as to what exact device you are using for what.

You have a server running on unix based machine and you are accessing it with a windows machine ? I will assume these are actual machines and not some VM stuff ?

The first fairly standard thing to try is to use the DMZ option rather than port forwarding. This tends to be much simpler so it is not as easily affected by strange mis configured option or maybe some firmware bug in the router.

Next are you trying to test from the windows machine on the same lan as your server BUT you are using the external wan ip. This requires special support in a router commonly called hairpin. Even if the router has this feature it is generally not documented.
You really want to test from a device that is actually remote on the internet. Maybe run the client machine using a vpn so that the traffic really comes from the internet.

After this it is hard to say what to try next. It has been a long time since I have done a packet capture on linux machine. I think it is a tcpdump command. Pretty much what you are looking to see is do you even get the packets and if you do does the machine respond. The packet capture happens before any kind of filter or firewall so you will see the packets even if they get blocked. If you do receive them then it is a server issue.

Thanks for the reply, I'm not sure what happened but today I noticed this morning my router was not working (WiFi would not connect) so I did a restart (turned the router off/on) and the ports are now working - again I have no idea why the restart I tried during the tests didn't resolve it (though that restart was executed via the interface, while the restart I did this morning was via physically turning the router off and back on).

I think it is definitely a router issue, so when I have more time I will do a factory reset and see if the firmware needs an update.