Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I recently set up a Fedora Core web server for my IT organization and I am a newbie to linux and even more of a newbie with iptables. For now, I need to permit outside users to access the web server on port 80, enable mysql connections on port 3306, and also allow ssh connections. Right now I don't need to really be restrictive on the source of the connections so I just need some general permissive rules to get things going. I tested internally trying to connect from my computer to the new server with the following rules and I cannot connect at all with iptables started. Once I stop iptables, I am able to get to the server, so I know something is wrong with my iptables configuration - I am just too much of a newbie to figure it out. Can someone help? :)

:INPUT ACCEPT [0:0]<br>
:FORWARD ACCEPT [0:0]<br>
:OUTPUT ACCEPT [0:0]<br>
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<br>
-A INPUT -p icmp -j ACCEPT<br>
-A INPUT -i lo -j ACCEPT<br>
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT<br>
-A INPUT -j REJECT --reject-with icmp-host-prohibited<br>
-A FORWARD -j REJECT --reject-with icmp-host-prohibited<br>
-A INPUT -p tcp --dport 80 -i eth0 -j ACCEPT<br>
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT<br>
COMMIT<br>

====================
UPDATE!!!

I changed my iptables rules to...

:INPUT ACCEPT [0:0]<br>
:FORWARD ACCEPT [0:0]<br>
:OUTPUT ACCEPT [0:0]<br>
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<br>
-A INPUT -p icmp -j ACCEPT<br>
-A INPUT -i lo -j ACCEPT<br>
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT<br>
-A INPUT -j REJECT --reject-with icmp-host-prohibited<br>
-A FORWARD -j REJECT --reject-with icmp-host-prohibited<br>
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT<br>
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT<br>
COMMIT<br><br>

After restarting iptables, I tested and I am still unable to connect to the server.

I ran iptables -L I get this...

Chain INPUT (policy ACCEPT)<br> 
target     prot opt source               destination<br>
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED<br> 
ACCEPT     icmp --  anywhere             anywhere<br>
ACCEPT     all  --  anywhere             anywhere<br>
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh<br> 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited<br> 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http<br> 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql<br><br>

Chain FORWARD (policy ACCEPT)<br>
target     prot opt source               destination<br>
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited<br><br>

Chain OUTPUT (policy ACCEPT)<br>
target     prot opt source               destination<br><br>

Again, if I stop iptables and then try connecting again then I am able to connect. So it still appears to be a problem with iptables (not networking issue). I'm baffled so any other help would be appreciated!!!

share|improve this question
    
Oh actually I think this is applied right, since the Policy is accept all the accept rules are redundant. See what the output of iptables -L is after starting it. –  Kyle Brandt Jun 24 '10 at 18:04

4 Answers 4

I think the problem is this rule:

-A INPUT -j REJECT --reject-with icmp-host-prohibited

That tells IPTables to reject everything coming in on the INPUT chain, i.e. all incoming packets. And since IPTables reads (and applies) its rules in order from top to bottom, for NEW packets coming in on ports 80 and 3306, that's the first rule that matches. So they all get rejected. The only packets that wouldn't be rejected by that rule are the ones coming into port 22, since the rule right above it says to accept them.

To fix it, just move that rule to the end of the file. That way, IPTables will encounter the rules saying to ACCEPT packets on ports 80 and 3306 first.

On a slightly related note, I've written an IPTables tutorial on my website that might have some useful information for you.

share|improve this answer
1  
This looks like the answer to me. If you use -I INPUT 3 rule that will insert into the right place I believe. Use the --line-numbers to see the proper place to insert it. I also recommend -v so you can see if the rule applies only to specific interfaces. –  Kyle Brandt Jul 31 '10 at 18:58

The simplest solution is just to repeat the following in the same spot of the file:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

But change the destination port to the ports you want to accept.

share|improve this answer

Rather than having a REJECT half way through your list, I would have a policy of REJECT on the INPUT and FORWARD chains. So

:INPUT REJECT [0:0]
:FORWARD REJECT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
COMMIT

That way you can append more rules (before the COMMIT if you are editing the files) instead of having to insert extra rules before the reject.

share|improve this answer

You do not need to bother with iptables at this level on Fedora if all you need are simple changes. It comes locked down but it has a simple firewall tool that will allow you to open ports (as simple as clicking on a button). You should use that while you are still learning.

Also, the basic, default firewall rules have some extra features (I think) like syn flood protection, etc, that your rule set is missing. You can always see what the rules are.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.