Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have tried to install vsftpd and I added this line to my iptables:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

However, when I start iptables. I get the following error:

Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: mangle filter nat         [  OK  ]
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules: iptables-restore: line 1 failed [FAILED]

And there is only the above line in the /etc/sysconfig/iptables file - what have I done wrong?

share|improve this question
You are not supposed to edit /etc/sysconfig/iptables by hand, and the name of the chain name you used is reserved for RedHat/Fedora automatic firewall configuration. – Juliano Mar 25 '11 at 22:26
I see, so what would the handle for CentOS be? In addition, how do you enable port 21 to be unblocked by the iptables? Apologies, I am new to this. – Abs Mar 25 '11 at 22:30
up vote 2 down vote accepted

The problem you have is that the RH-Firewall-1-INPUT chain isn't standard so you have to create it. Having a single line in your iptables config isn't ideal either. A fairly basic /etc/sysconfig/iptables is

:OUTPUT ACCEPT [486:51620]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

You should add your rule to the above before the REJECT line.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.