Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have iptables config like this:

iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT

iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -j ACCEPT

Also, I have apache virtual host:

<VirtualHost *:80>
    ServerName wiki.myite.com
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>

    ProxyPass / http://localhost:8901/
    ProxyPassReverse /  http://localhost:8901/
    <Location />
        Order allow,deny
        Allow from all
    </Location>
</VirtualHost>

My primary domain www.mysite.com is working well with this configuration (I don't use proxy redirect on it). But my virtual host wiki.mysite.com is not responding.

Please, help me to setup iptables config to allow wiki.mysite.com working too. I think, I need to setup iptables FORWARDING options, but I don't know how.

update:

I have 1 server with 1 IP. On server I have apache2.2 on 80 port. Also I have tomcat6 on 8901 port. In apache I setup to forwarding domain wiki.mysite.com to tomcat (mysite.com:8901).

I want to secure my server by disabling all ports, except 80, 22 and 443.

share|improve this question
    
we're going to need to know a little more about your network topology –  Antoine Benkemoun Feb 8 '10 at 15:23

2 Answers 2

Well, if you're redirecting to port 8901 and you haven't marked your lo interface as "trusted" by accepting all from it, then you're probably just blocking yourself at your own firewall.

Assuming you've set up the site to correctly listen at 8901, you should add another line:

iptables -A INPUT -p tcp --dport 8901 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 8901 -j ACCEPT

Or just add:

iptables -A INPUT -i lo -j ACCEPT

So your machine will know to accept localhost packets on all ports.

share|improve this answer
    
No, man, I want to close all ports, except 80, 22 and 443 –  swdalex Feb 8 '10 at 15:37

I solve this problem by adding following code to my iptables config:

iptables -A INPUT -d 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -s 127.0.0.1 -j ACCEPT

I'm opened all ports from localhost and to localhost.

It is seems like Satanicpuppy said, but:

iptables -A INPUT -i lo -j ACCEPT 

opened all ports for all.

share|improve this answer
    
It should be all ports FROM the localhost. Not all ports from any external interface. Check it from a second machine. –  Satanicpuppy Feb 8 '10 at 19:58
    
@Satanicpuppy is right iptables -A INPUT -i lo -j ACCEPT just allows local loopback services. It doesn't open all ports for all. –  George Tasioulis Oct 1 '11 at 11:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.