Assistance with opening additional ports - CentOS

Question

I'm trying to open an additional outgoing port on my VPS (port 5900).

Here is my /etc/sysconfig/iptables:

# Generated by iptables-save v1.3.5 on Sun Jul 10 11:27:12 2011
*mangle
:PREROUTING ACCEPT [68:4952]
:INPUT ACCEPT [68:4952]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [60:7060]
:POSTROUTING ACCEPT [60:7060]
COMMIT
# Completed on Sun Jul 10 11:27:12 2011
# Generated by iptables-save v1.3.5 on Sun Jul 10 11:27:12 2011
*filter
:INPUT ACCEPT [68:4952]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [60:7060]
:RH-Firewall-1-INPUT - [0:0]
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5900 -j ACCEPT 
COMMIT
# Completed on Sun Jul 10 11:27:12 2011
# Generated by iptables-save v1.3.5 on Sun Jul 10 11:27:12 2011
*nat
:PREROUTING ACCEPT [18:1080]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Sun Jul 10 11:27:12 2011

However, the port 5900 is still closed.

Can someone assist me with this? Thanks.

Answer 1

I am assuming that you mean "incoming", not "outgoing" port 5900, because your outgoing port is properly opened by your current rules.

Usually I get rid of the RH-Firewall-1-INPUT chain and use the following:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Allow traffic from the loopback interface
-A INPUT -i lo -j ACCEPT

# Allow ICMP traffic as it helps with connection diagnostics
-A INPUT -p icmp --icmp-type any -j ACCEPT

# Allow traffic from already existing connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow connections on port 5900
-A INPUT -p tcp --dport 5900 -m state --state NEW -j ACCEPT

COMMIT

But if you want to keep as close to the original CentOS configuration as possible, you could try the following:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type 255 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 5900 -m state --state NEW -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

COMMIT

The problem with your current ruleset is that you don't send all incoming traffic to the RH-Firewall-1-INPUT chain, which is done with the following line:

-A INPUT -j RH-Firewall-1-INPUT

Also, don't forget to reload your rules with service iptables restart.

Answer 2

The policy on your output chain is accept. There are no rules denying output on port 5900 in your configuration.

Are you sure that you have something listening on port 5900 ?

try

sudo lsof -l :5900

or

sudo netstat -an | grep LISTEN | grep 5900

to see what (if anything) is attached.

Answer 3

If this is for VNC and your VPS is hosted on Amazon, then make sure to open the security restrictions in your amazon security group as well (by default amazon only allow port 22 and 80).

Output port are normally not blocked -- so probably nothing to do on the host originating the connection.

Also, the firewall rule for 5900 should be on the receiving host (i.e. your VPS), And I would have guessed it would have to look something like this;

-A INPUT -p tcp -m tcp -m state --dport 5800 --state NEW -j ACCEPT

BUT with the addition of checking that the IP is from you network and not from the internet in general (opening VNC to the public is probably not secure).

Finally, if your organization also have a firewall, you may want to check if the firewall prevent outgoing connection on unauthorized ports.