outgoing ports on fsockopen

[Anon]

Hi,

I'm using IPChains to restrict incoming ports on my webserver. I have a webmail PHP script that does fsockopen to port 110 to retrieve pop3 email. I've created incoming holes on ipchains for port 110, which theoretically, should take care of this. However, the fact is that with ipchains up, the PHP script times out and doesn't work. Without ipchains, the script works without problem.

I'm assuming that this means that when you issue an fsockopen 110 command in PHP, it doesn't really use 110 as the outgoing port on the server. Does anyone know the ports that PHP uses or is there anywhere I can predefine outgoing ports for PHP?

I've looked at php.ini, but there doesn't seem to be anything there that will help..

Thanks.

Greg

[Anon]

Well,

normally, there is no point in restricting the outgoing ports of the machine, only the incoming ones.

When you try to establish a connection to port 110 on a remote machine, the kernels task is to assign a local port that will recieve data on this connection. These ports are, unless you have made modifications to the kernel, above 1024. So if 1025 is free, it'll most likely be used. If not, increment by one and retry, etc.

So, don't block outgoing traffic on any ports, and the problem will most likely be solved. I can't really see any good reason to block them anyway, unless you're attempting to prevent all sorts of tcp traffic from this machine.

Hint, try 'netstat -an' (without the quotes) as root, and you'll see what ports are used locally and remotely on connections. However, nothing will (obviously) show up here if the connection is killed by ipchains (or, maybe with a WAIT flag, I'm not quite sure).

Hope it helped.

[Anon]

Hi,

Thanks for the heads up on ports 1024 and above..

Yeah.. I don't have restrictions on outgoing, just incoming. I think the the script is able to send messages out, just that ipchains is blocking the incoming response to the port, resulting in it timing out. I'll try opening up a hole on ipchains around there to see if it'll help.

Do you know if there's anyway I can predefine the ports used?

[Anon]

Hi,

Just did a little experiment.. Turned off ipchains and then tracked opened ports using 'netstat -an' as you suggested.. Seems my script is opening up ports at around 33017 and above.. so, I opened up tcp ports from 33000 to 34000 to see if it will work..

Guess what.. still doesn't work with ipchains up... hmmm... Is pop3 UDP?