Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to open an additional outgoing port on my VPS (port 5900).

Here is my /etc/sysconfig/iptables:

# Generated by iptables-save v1.3.5 on Sun Jul 10 11:27:12 2011
*mangle
:PREROUTING ACCEPT [68:4952]
:INPUT ACCEPT [68:4952]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [60:7060]
:POSTROUTING ACCEPT [60:7060]
COMMIT
# Completed on Sun Jul 10 11:27:12 2011
# Generated by iptables-save v1.3.5 on Sun Jul 10 11:27:12 2011
*filter
:INPUT ACCEPT [68:4952]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [60:7060]
:RH-Firewall-1-INPUT - [0:0]
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5900 -j ACCEPT 
COMMIT
# Completed on Sun Jul 10 11:27:12 2011
# Generated by iptables-save v1.3.5 on Sun Jul 10 11:27:12 2011
*nat
:PREROUTING ACCEPT [18:1080]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Sun Jul 10 11:27:12 2011

However, the port 5900 is still closed.

Can someone assist me with this? Thanks.

share|improve this question
    
1) The rule you have for 5900 is an input rule, not output. 2) Normally output is not blocket by firewall, only input. Why do you think the outgoing port 5900 is blocked? Is it not likely that it is either a external firewall issue, or that is is the 5900 incomming on the receing port which is blocked? How did you test it? –  Soren Jul 10 '11 at 7:44
    
Also, if the VPS is accessed over a VPN, then most VPN implementations runs over UDP and not TCP –  Soren Jul 10 '11 at 7:48
add comment

3 Answers

The policy on your output chain is accept. There are no rules denying output on port 5900 in your configuration.

Are you sure that you have something listening on port 5900 ?

try

sudo lsof -l :5900

or

sudo netstat -an | grep LISTEN | grep 5900

to see what (if anything) is attached.

share|improve this answer
    
It's not used by anything. –  Spencer Jul 10 '11 at 14:22
    
If there is nothing there then you have to fix that before 'fixing' your firewall. –  Iain Jul 10 '11 at 14:28
    
How do I go by 'fixing' that? Sorry, I'm new to this VPS firewall stuff. –  Spencer Jul 10 '11 at 14:29
    
I have no idea, as you haven't said what your running that needs to use port 5900. If you turn your firewall off /sbin/service iptables stop can you do what you want ? –  Iain Jul 10 '11 at 14:38
    
Apologies for the lack of information. I need the port 5900 so I can run a gaming server. –  Spencer Jul 10 '11 at 14:41
show 1 more comment

I am assuming that you mean "incoming", not "outgoing" port 5900, because your outgoing port is properly opened by your current rules.

Usually I get rid of the RH-Firewall-1-INPUT chain and use the following:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]

# Allow traffic from the loopback interface
-A INPUT -i lo -j ACCEPT

# Allow ICMP traffic as it helps with connection diagnostics
-A INPUT -p icmp --icmp-type any -j ACCEPT

# Allow traffic from already existing connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow connections on port 5900
-A INPUT -p tcp --dport 5900 -m state --state NEW -j ACCEPT

COMMIT

But if you want to keep as close to the original CentOS configuration as possible, you could try the following:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type 255 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -m tcp -p tcp --dport 5900 -m state --state NEW -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

COMMIT

The problem with your current ruleset is that you don't send all incoming traffic to the RH-Firewall-1-INPUT chain, which is done with the following line:

-A INPUT -j RH-Firewall-1-INPUT

Also, don't forget to reload your rules with service iptables restart.

share|improve this answer
    
I tried both rules, however, it still says it's closed. –  Spencer Jul 10 '11 at 14:21
    
Can you please explain what exactly are you trying to do? This way it will be much easier for us to help you. I am asking because your answers make me think that your problem isn't with the firewall, but with something else. –  Vladimir Blaskov Jul 10 '11 at 14:42
    
I'm not quite sure myself. I just need the port 5900 open so I can run a gaming server. –  Spencer Jul 10 '11 at 14:43
    
Run the following command to check if your gaming server is running and listening on the right port: netstat -punta 2>/dev/null | grep LISTEN | grep :5900 –  Vladimir Blaskov Jul 10 '11 at 14:53
    
Ok, it's more of a "login server" file that runs off that port. To start the login server, I run "screen php login-server.php". –  Spencer Jul 10 '11 at 14:56
show 3 more comments

If this is for VNC and your VPS is hosted on Amazon, then make sure to open the security restrictions in your amazon security group as well (by default amazon only allow port 22 and 80).

Output port are normally not blocked -- so probably nothing to do on the host originating the connection.

Also, the firewall rule for 5900 should be on the receiving host (i.e. your VPS), And I would have guessed it would have to look something like this;

-A INPUT -p tcp -m tcp -m state --dport 5800 --state NEW -j ACCEPT

BUT with the addition of checking that the IP is from you network and not from the internet in general (opening VNC to the public is probably not secure).

Finally, if your organization also have a firewall, you may want to check if the firewall prevent outgoing connection on unauthorized ports.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.