Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have tried to install vsftpd and I added this line to my iptables:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT

However, when I start iptables. I get the following error:

Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: mangle filter nat         [  OK  ]
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules: iptables-restore: line 1 failed [FAILED]

And there is only the above line in the /etc/sysconfig/iptables file - what have I done wrong?

share|improve this question
    
You are not supposed to edit /etc/sysconfig/iptables by hand, and the name of the chain name you used is reserved for RedHat/Fedora automatic firewall configuration. –  Juliano Mar 25 '11 at 22:26
    
I see, so what would the handle for CentOS be? In addition, how do you enable port 21 to be unblocked by the iptables? Apologies, I am new to this. –  Abs Mar 25 '11 at 22:30

1 Answer 1

up vote 2 down vote accepted

The problem you have is that the RH-Firewall-1-INPUT chain isn't standard so you have to create it. Having a single line in your iptables config isn't ideal either. A fairly basic /etc/sysconfig/iptables is

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [486:51620]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

You should add your rule to the above before the REJECT line.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.