iptables open port not working for flask tutorial (port 5000)

Question

I'm trying to do the flask tutorial in python, which runs a server on port 5000. I can connect to my (remote) server when I stop iptables, but when I have iptables running, the connection times out.

I can't figure which of the rules is preventing my connection.

# /sbin/iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:commplex-main
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:commplex-main

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:distinct
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

So when I stop iptables, I can connect. When it's running, I can't connect. This suggests it's the firewall doing the blocking, right?

Any thoughts on where to start?

Answer 1

It looks like you used something like

iptables -A INPUT ...

to add your rules for port 5000 to your firewall configuration.

Note that the first thing your INPUT chain does is send all packets to the RH-Firewall-1-INPUT chain. The last thing this does is

REJECT     all  --  anywhere     anywhere     reject-with icmp-host-prohibited

Ipatbles processes packets and acts upon the rules in the order then appear in the list and the first wins. This means that packets never reach your

tcp  --  anywhere             anywhere            state NEW tcp dpt:commplex-main
tcp  --  anywhere             anywhere            tcp dpt:commplex-main

rules at the end of the INPUT chain.

You need to add the rules for port 5000 to the INPUT or RH-Firewall-1-INPUT chain using the -I (insert) option

iptables -I RH-Firewall-1-INPUT ...

because using -A (add) puts the rules at the end of the chain whereas -I puts them after the provided line-number or at line 1 if not --lune-number is provided.