Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Have CentOS installed with httpd. Can connect with lynx both to http://localhost and to (the real IP) from inside the machine. Can't connect from outside. Here is an excerpt from the /etc/httpd/conf/httpd.conf:


    DocumentRoot /var/www/vhost1
    ErrorLog logs/vhost1-error_log
    CustomLog logs/vhost1-access_log common

I am trying to connect from the machine that resides on the same subnet (as far as I know about it).

Nothing suspicious in the log files. Any advises please?

Update: while running iptables -L I've got the following line (maybe it's related): REJECT all -- anywhere anywhere reject-with icmp-host-prohibited.

Update N2: iptables -vnL output:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     udp  --  virbr0 *             udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *             tcp dpt:53
    0     0 ACCEPT     udp  --  virbr0 *             udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *             tcp dpt:67
1576K 1643M RH-Firewall-1-INPUT  all  --  *      *  

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      virbr0      state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 *
    0     0 ACCEPT     all  --  virbr0 virbr0  
    0     0 REJECT     all  --  *      virbr0             reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr0 *             reject-with icmp-port-unreachable
    0     0 RH-Firewall-1-INPUT  all  --  *      *  

Chain OUTPUT (policy ACCEPT 354K packets, 58M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain RH-Firewall-1-INPUT (2 references)
 pkts bytes target     prot opt in     out     source               destination
  922  823K ACCEPT     all  --  lo     *  
   19  1412 ACCEPT     icmp --  *      *             icmp type 255
    0     0 ACCEPT     esp  --  *      *  
    0     0 ACCEPT     ah   --  *      *  
 159K   28M ACCEPT     udp  --  *      *           udp dpt:5353
 2869  640K ACCEPT     udp  --  *      *             udp dpt:631
    0     0 ACCEPT     tcp  --  *      *             tcp dpt:631
1239K 1589M ACCEPT     all  --  *      *             state RELATED,ESTABLISHED
    8  1064 ACCEPT     tcp  --  *      *             state NEW tcp dpt:22
 175K   25M REJECT     all  --  *      *             reject-with icmp-host-prohibited
share|improve this question
You need to give WAY more information. – Philip Reynolds Jul 11 '11 at 13:33
@Phil: kindly advise which information would you like to get and I'll happily provide it. – BreakPhreak Jul 11 '11 at 13:35
@BreakFreak: "REJECT all" is probably the cause! – Cez Jul 11 '11 at 13:35
@Cez: can you please tell which is the best way to remove the line (this is not a production machine)? Also, can you please post it as an answer, so I'll "accept" it if it helps? – BreakPhreak Jul 11 '11 at 13:38
@BreakFreak: have added an answer – Cez Jul 11 '11 at 13:41
up vote 4 down vote accepted

Try this to see if it helps:

sudo /sbin/iptables -A INPUT -p tcp --dport http -j ACCEPT

If you use the following beforehand then you can easily revert back:

/sbin/iptables-save > /tmp/fw

If you want to completely turn off iptables (although better to configure it appropriately) then use:

sudo /sbin/chkconfig iptables off

Otherwise, make the rule persist save it to /etc/sysconfig/iptables:

/sbin/iptables-save > /etc/sysconfig/iptables
share|improve this answer
Just switched off the firewall as advised above and it worked. Now the point is how to switch it forever. – BreakPhreak Jul 11 '11 at 13:43
Note: with -A INPUT the new rule comes after all other rules in the input chain. That means that the new rule may come after a general REJECT rule, making it useless. To add the new rule at the top, use -I INPUT instead – Johan Lundberg Apr 3 '14 at 7:26

This is often indicative of a firewall problem, either on your local system or on your network. What does your local iptables firewall look like?

# iptables -vnL

You can temporarily disable the local firewall by running:

# /sbin/service iptables stop

If things work after this, it was definitely a firewall problem and you'll need to sort that out.

If you don't have a local firewall, is there one elsewhere on your network?

share|improve this answer
Updated the post with iptables -vnL output. – BreakPhreak Jul 11 '11 at 13:41
Yep, stopping the iptables makes the job! Now the question is how to remove the firewall. No need in it - this is a pure dev machine. – BreakPhreak Jul 11 '11 at 13:42
rm /etc/sysconfig/iptables – larsks Jul 11 '11 at 14:08

Yeah, I'd say that firewall rule probably isn't helping things (although it depends what else is in the firewall ruleset). It could also (in theory) be a problem with the outgoing firewall on the machine you're connecting from, or a proxy config problem, or the phase of the moon.

A complete firewall ruleset and some detailed network troubleshooting results would go a long way to narrowing down the problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.