Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


As Khaled suggested, i changed my netstat command

netstat -lnp | grep 3899
tcp        0      0 :::3899           :::*              LISTEN      10333/sshd

So shouldn't it be listening?

I changed my ssh port on my centos 5.5 box to 3899. But I can't seem to login remotely to it. I have done this before but the last time, I didn't need to make any other changes to make it work.

iptables -L | grep 3899
[empty response]

iptables -L | grep 22
[empty response]

iptables -L | grep ssh
ACCEPT     tcp  --  anywhere       anywhere       state NEW tcp dpt:ssh
share|improve this question
up vote 2 down vote accepted

Yes, you probably need to adjust your firewall rules. To see your current rules:

iptables -nvL

If you see a bunch of ACCEPT rules and a REJECT rule at the end, that means your host is blocking all incoming connections except the specified ones.

I think you can use the system-config-securitylevel menu-based tool to open custom ports. Run that program in a terminal and choose the 'customize' button. Add 3899:tcp to the other ports list and save your changes. I'm not sure if system-config-securitylevel takes port numbers instead of service names. If specifying the port number in that tool doesn't work, you can try adding your custom 'myssh' service name to /etc/services and then using that name in system-config-securitylevel.

You can run

nmap -sS -v

from an outside machine to scan your system to determine which ports are open.

Another way to make this change is to hand edit /etc/sysconfig/iptables, and copy the existing ssh entry to another entry right below it, but change the port from ssh to 3899. Note that it's easy to screw up your firewall config by hand-editing the iptables file, so be very cautious if you go this route. After you make changes, reboot the machine, or run /etc/init.d/iptables restart to load your changes.

share|improve this answer
Thank you for the detailed answer. I never new about system-config-securitylevel. I changed the rule for 22 to 3899 in /etc/sysconfig/iptables and it works perfectly now. If your answer wasn't so detailed and generally helpful, I would have ignored it seeing that you asked me to reboot a linux machine =D – gAMBOOKa Feb 17 '11 at 18:56
'reboot the machine' is the simple answer, but note you can also use iptables -I chain num to insert rules in your running iptables without even flushing the existing rules. That's the maximum uptime solution, no reboot required. :) – Phil Hollenback Feb 17 '11 at 19:03

The answer is probably yes -- If your iptables rules are active the destination port SSH (dpt:ssh) rule only covers port 22 -- the standard SSH port as assigned by IANA & listed in /etc/services.

You will need to change that rule to allow traffic to port 3899 (or whatever your new SSH port is) - On CentOS I believe the ipables rules are located in /etc/sysconfig/iptables

share|improve this answer
  1. You need to make sure that SSH deamon is really listening on the new port using netstat -lnp | grep 3899.

  2. Also, you need to check your firewall settings. Allow the new port to pass through.

If you are getting a connection refused error, then you have a problem in point 1. If you are getting a connection timeout error, then you have a problem in point 2.

share|improve this answer
Update answer with result – gAMBOOKa Feb 17 '11 at 18:48

run this and it should add entry to allow connecting to port 3899

iptables -I INPUT -p tcp --dport 3899 -j ACCEPT

your post does not show what is default policy for INPUT chain, or what other rules are.

copy paste here output of

iptables-save and netstat -nlp then we will know all the details needed to help you.

share|improve this answer

CentOS wil use port 22 regardless of the use of dpt:ssh You should manually open port 3899

You can do this by running this command:

iptables -I INPUT -p tcp --dport 3899 -j ACCEPT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.