Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have iptables config like this:

iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT

iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -j ACCEPT

Also, I have apache virtual host:

<VirtualHost *:80>
    <Proxy *>
        Order deny,allow
        Allow from all

    ProxyPass / http://localhost:8901/
    ProxyPassReverse /  http://localhost:8901/
    <Location />
        Order allow,deny
        Allow from all

My primary domain is working well with this configuration (I don't use proxy redirect on it). But my virtual host is not responding.

Please, help me to setup iptables config to allow working too. I think, I need to setup iptables FORWARDING options, but I don't know how.


I have 1 server with 1 IP. On server I have apache2.2 on 80 port. Also I have tomcat6 on 8901 port. In apache I setup to forwarding domain to tomcat (

I want to secure my server by disabling all ports, except 80, 22 and 443.

share|improve this question
we're going to need to know a little more about your network topology – Antoine Benkemoun Feb 8 '10 at 15:23

Well, if you're redirecting to port 8901 and you haven't marked your lo interface as "trusted" by accepting all from it, then you're probably just blocking yourself at your own firewall.

Assuming you've set up the site to correctly listen at 8901, you should add another line:

iptables -A INPUT -p tcp --dport 8901 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 8901 -j ACCEPT

Or just add:

iptables -A INPUT -i lo -j ACCEPT

So your machine will know to accept localhost packets on all ports.

share|improve this answer
No, man, I want to close all ports, except 80, 22 and 443 – swdalex Feb 8 '10 at 15:37

I solve this problem by adding following code to my iptables config:

iptables -A INPUT -d -j ACCEPT
iptables -A OUTPUT -s -j ACCEPT

I'm opened all ports from localhost and to localhost.

It is seems like Satanicpuppy said, but:

iptables -A INPUT -i lo -j ACCEPT 

opened all ports for all.

share|improve this answer
It should be all ports FROM the localhost. Not all ports from any external interface. Check it from a second machine. – Satanicpuppy Feb 8 '10 at 19:58
@Satanicpuppy is right iptables -A INPUT -i lo -j ACCEPT just allows local loopback services. It doesn't open all ports for all. – George Tasioulis Oct 1 '11 at 11:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.