Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have set up some IPTables rules (on Centos) using netfilter from the command line. SSH is allowed and FTP is not. When I test this out it works fine.

But then if I connect to the gnome desktop and look at system -> administration -> Security Level and Firewall (which I think is the GUI for system-config-securitylevel) it shows the firewall enabled and none of the available services trusted including SSH.

I was expecting it to reflect the iptables rules I created.

This suggests to me that the IPTables and system-config-securitylevel rules are seperate and that the IPTables rules take precedence. However, the book and reading and the surfing I've done seems to suggest they are just two interfaces to the same firewall.

Can anyone clear this up for me. Thanks in advance. C

SSH is on th usual port 22, here's my iptables rules:

Chain INPUT (policy DROP 1000 packets, 144K bytes)
 pkts bytes target     prot opt in     out     source               destination
 9024  900K fail2ban-SSH  tcp  --  *      *             tcp dpt:22
11393 1107K ACCEPT     tcp  --  *      *             tcp dpt:22
29519 3091K ACCEPT     tcp  --  eth0   *             tcp dpt:80
17465 1952K ACCEPT     all  --  lo     *  
 1287  735K ACCEPT     all  --  *      *             state RELATED,ESTABLISHED

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 55448 packets, 37M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain fail2ban-SSH (1 references)
 pkts bytes target     prot opt in     out     source               destination
 8987  895K RETURN     all  --  *      *  

On the gnome desk top under system -> administration -> Security Level and Firewall I have a window that shows the firewall enabled and a list of services that I can tick to be trusted: FTP, Mail, NS4, SSH, samba, HTTPS, HTTP, telnet None appear ticked despite the above IPtables rules.

share|improve this question
up vote 1 down vote accepted

For starters is ssh running on a custom port?

Secondly, can you post a copy of your iptables ruleset, and a description of the gui interfaces set.

to list iptables:

iptables -L -n -v


It looks to be a number of things, one is the addition of fail2ban. Not to mention that system-config-securitylevel configures the firewall in a very specific way, anything outside of this exact setup is going to cause it to not recognize those services since it's not configured the same way. That's the reason for the difference, and to be expected.

What is listed in iptables are the rules that are in effect. Regardless of what system-config-securitylevel states, iptables -L will always show the existing and active ruleset.

share|improve this answer
Thanks, main question edited to add the info you're after. – columbo Apr 12 '11 at 15:38
Just saw, my response is updated as well to include your answer :-) – rfelsburg Apr 12 '11 at 15:47
OK, so I think I'm getting it now. So is system-config-securitylevel just a means to simplify the creation of iptables rules? And it sometimes fails to pick up what has been done at the command line level. I'm mildly disturbed that system-config-securitylevel shows incorrect info. If I were to forget (I won't) I might go into system-config-securitylevel and say add FTP by ticking it, think everything else is working fine and click apply at which point I'm assuming system-config-securitylevel will whip away SSH and I'll be cut off forever. Is there a way to force it to see things correctly? – columbo Apr 12 '11 at 15:56
This is why most sysadmins don't use the gui, unless the gui configured the firewall in the first place, any change is going to rework your whole iptables layout. For instance, if you had your iptables setup as they are now, and went in and added ftp, its not going to just add an ftp rule, it's going to save the firewall as it's set in the gui, and overwrite your existing iptables setup. – rfelsburg Apr 12 '11 at 15:59
Right, OK. I'm tempted to remove the grahical and text versions of system-config-securitylevel, does that sound reasonable or can you think of a reason why that's a bad idea. – columbo Apr 12 '11 at 16:04

Firewall is different from SELinux. Firewall is for stopping access via network ports, and SELinux is local protection (enhanced permissions, file labeling, and process security). They can be configured separately, and they act independently.

Neither one takes preference, it's just that SSH traffic will not reach your box at all if it is blocked by the firewall. The SELinux SSH rules are there to make sure that the SSH process does not try to over-step it's bounds while it is running on your actual server (write to weird files, update things it shouldn't, etc).

In short, you can think of SELinux as local protection, and a firewall as remote protection (mostly true).

share|improve this answer
I thought that the firewall accessed from the GUI was just a front end to the IPtables and that SE linux is something else. – columbo Apr 12 '11 at 15:46
It is. The frontend just configures iptables based on the options checked, however it does it in a very specific way. SELinux is an application layer security context system. With Cent it tends to be started/stopped via setenforce 1/setenforce 0. And permenantly set via /etc/selinux/config – rfelsburg Apr 12 '11 at 15:53
I've just had a look and SELinux is disabled. I think I'm going to have to look into that. – columbo Apr 12 '11 at 16:00
Would recommend it, however I would look at using permissive first and looking what is being denied and then fixing your selinux contexts/rules and then enforcing, otherwise you are likely to create some problems. – rfelsburg Apr 12 '11 at 16:09
The front-end tool can be confusing because it combines the two into a single tool, but they are indeed separate... – landonz Apr 12 '11 at 16:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.