2

I've installed postgre on a CentOS server.

I basically followed this guide here: PostgreSQL On the last step it says I need Open TCP port 5432 and to do so I need to add the following line to my /etc/sysconfig/iptables:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5432 -j ACCEPT

restarting iptables yields an error on the new line, it seems it doesn't like the RH-Firewall-1-INPUT part. The problem is that, even if i STOP the iptables service the port 5432 seems to remain closed.

Any help will be appreciated.

Edit:

iptables -L -nv
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 2331  187K RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 2080 packets, 490K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain RH-Firewall-1-INPUT (2 references)
 pkts bytes target     prot opt in     out     source               destination
    1    29 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  eth0.4 *       0.0.0.0/0            0.0.0.0/0
 2330  187K ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  eth0.1 *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  eth0.2 *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  eth0.3 *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 255
    0     0 ACCEPT     esp  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     ah   --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251         udp dpt:5353
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:631
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:631
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:5432
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:23
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:25
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:443
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

ps aux | grep postgre
postgres 20132  0.0  0.0 120692  3336 ?        S    15:41   0:00 /usr/bin/postmaster -p 5432 -D /var/lib/pgsql/data
postgres 20134  0.0  0.0 109872   704 ?        S    15:41   0:00 postgres: logger process
postgres 20136  0.0  0.0 120692   980 ?        S    15:41   0:00 postgres: writer process
postgres 20137  0.0  0.0 110872   700 ?        S    15:41   0:00 postgres: stats buffer process
postgres 20138  0.0  0.0 110060   876 ?        S    15:41   0:00 postgres: stats collector process
root     20299  0.0  0.0  61152   728 pts/0    S+   16:08   0:00 grep postgre

EDIT 2: This is what happenes when I turn off iptables.

[maguirre@server ~]# /etc/init.d/iptables stop
Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: filter                    [  OK  ]
Unloading iptables modules:                                [  OK  ]
[maguirre@server ~]# iptables -L -nv
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination 
1
  • Sorry, can't comment yet! Confirm that PostreSQL is actually listening by using lsof -i:5432. You should see something like *:postgresql or *:5432 in there. If the first part is not an asterisk or an IP address that isn't localhost, then your Postgres configuration is incorrect, because you're binding to localhost and not an externally accessible IP.
    – Xiol
    Jul 23, 2011 at 20:11

4 Answers 4

1

Are you adding to :RH-Firewall-1-INPUT - [0:0] section? Could you also please post an error here?

4
  • Yeah that was not in there (it's my first time dealing with this kind of thing) I added it and put back the line on the initial post and the restart now works but the port remains closed. Like I said the file was not there at first, I then read somewhere I could add rules on the fly and did this iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 10.10.29.50 --dport 5432 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp -s 10.10.29.50 --sport 5432 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT after that the file was created
    – irco
    Jun 8, 2011 at 16:15
  • Well, you can try this instead: -A INPUT -m tcp -p tcp --dport 5432 -j ACCEPT - just add you somewhere at the top of the file below *filter and strings started with : and above first COMMIT
    – Alex
    Jun 8, 2011 at 16:32
  • alright I added that. I restarted iptables service and still no luck. Is it normal that even if I turn iptables off that the port would still be closed?
    – irco
    Jun 8, 2011 at 17:07
  • I went ahead and tried system-config-securitylevel-tui selected enabled added the port (and it recognized it to be postgresql) selected SELinux enforcing and selected ok, but when it exits it tells me "/usr/bin/setenforce: SELinux is disabled". The iptables file is recreated like you said but the port is closed....this is frustrating
    – irco
    Jun 8, 2011 at 17:42
1

If all your doing is trying to open one port, then the program called Firestarter might help right? They also have a distrobution for CentOS I think.

1

You are almost there. You need to open the table like so:

iptables -I INPUT 1 -m tcp -p tcp --dport 5432 -j ACCEPT

Here, you are going to insert a rule in for the default INPUT chain (in this case, RH-Firewall-1 or 1). The option "-m" is a matching operator that allows you to filter based on protocol, state or session. However, since you only care that the port is open, you just make sure that it is a tcp packet (you don't probably don't need -p, but for good practice, just add that in anyway). From there, you just need to specify the default port and you are good to go.

At that, it will the rule right before the REJECT statement. GO ahead and save it like so:

service iptables save

And then restart:

service iptables restart

If the rule didn't get inserted in the right place, backup /etc/sysconfig/iptables and then edit the file, adding the following the REJECT:

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT

Save the file and do another restart of iptables.

0

Have a look at the file. There should be other rules referencing the same chain, and the chain should be created at the top with a line like this:

:RH-Firewall-1-INPUT - [0:0]

I am not sure that accepting only NEW packets will actually do the trick for you. This will only work of there is also a rule in there to accept all packets in states ESTABLISHED and RELATED (which is the default, but you never know).

You can check whether this chain does exist by running

iptables -L -nv

This should show a section somewhere in the output saying

Chain RH-Firewall-1-INPUT (policy ...)

None of this will work if you have any other firewall packages installed, as they will bypass the default firewall setup and install their own rules.

EDIT Here is the content of this file from on of our fedora boxes. Please note the comments at the top.

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
11
  • I don't have that at the top of the file, in fact I dont think the file even existed when I first took over this machine (I was kinda thrown into doing this and never dealt with it) I read somewhere else that it could be done on the fly so i did this: iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d 10.10.29.50 --dport 5432 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp -s 10.10.29.50 --sport 5432 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT And then iptables file was created. I can actually see some of that stuff in there now
    – irco
    Jun 8, 2011 at 16:06
  • I'm wondering if there is a way to start over, cause all i see in the iptables file is the things I've been testing
    – irco
    Jun 8, 2011 at 16:15
  • @irco, you can use a system-config-securitylevel-tui command-line utility to create a RedHat-style initial set of firewall rules in /etc/sysconfig/iptables
    – Alex
    Jun 8, 2011 at 16:39
  • I used system-config-securitylevel-tui to restore the iptables and it even recognizes that 5432 is POSTGRESQL but the scanning the port still says it's closed. is there any way to check for other firewalls? or anything else controlling the ports?
    – irco
    Jun 8, 2011 at 19:03
  • Could you please update your post with the output of "iptables -L -nv" and "ps aux | grep postgre"
    – wolfgangsz
    Jun 8, 2011 at 19:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .