Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a database server (specifically Tokyo Tyrant) running on one machine and a web server running on a separate machine.

I need to setup iptables on both machines so that the web server can make queries on the database server. Currently, I get "connection refused" when I try this from the web server:

tcrmgr list ${ip_of_db_server}:${port}

Preferably, the db server should only accept traffic from the ip address of the web server.

I am new to iptables so this may be obvious, but I am struggling.

Any help much appreciated -thanks!

(Edit: NB. here's a list of my iptables rules:

sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www
DROP       all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere          tcp dpt:1948 


share|improve this question

migrated from Feb 16 '11 at 10:05

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

Run something like this on the database server to allow inbound connections:

/sbin/iptables -I INPUT 1 -p tcp -d ${ip_of_db_server} --dport ${port} -j ACCEPT

To see current rules in effect, run:

/sbin/iptables -L -v

See for a basic intro.

share|improve this answer
Thanks -I had tried this already, but it still isn't working. It's good to know that I was on the right track though... I'm beginning to wonder if maybe this isn't an iptables issue after all (maybe it is the configuration of the database server?) – Pete W Feb 16 '11 at 6:32
Have you tried plain old telnet ${host} ${port} to see if the server listens on that port? (Try first from within the server itself, if that works from a 3rd independent machine, then finally from the web server) – Eero Feb 16 '11 at 6:43
OK -telnet from the db server to itself using the required port seems to connect fine. But when I try the same thing from the machine hosting the web server it doesn't connect failing with : "telnet: Unable to connect to remote host: Connection timed out" -just had a thought -do I need to restart iptables or do the rules take effect immediately? – Pete W Feb 16 '11 at 7:00
If you run /sbin/iptables directly, then the effect is immediate (if you edit a script, you should of course rerun the script). Rule order matters. ACCEPT should be before DROP. Are you sure you do not have another (non-software) firewall between the servers? Please add iptables -L -v output to the question if possible. – Eero Feb 16 '11 at 7:10
See also… – Eero Feb 16 '11 at 7:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.