Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've set up a CentOS 5.6 development server running as a virtual machine under Virtual PC 2007, in order to have a play with Node.js. Everything is up and running, but I can't seem to access port 8234, which is the port the Node server is running on.

I know the server is running because I can wget localhost:8234 and retrieve an HTML file containing 'Hello World', which is correct.

If I use a port scanner, I can see that all the ports mentioned in the Allow Incoming section are open and responding to pings, but nothing else.

I've run setup and set things as follows:

Firewall Config

Port Config

To my mind, these settings should have turned off the firewall and be allowing anything that comes in on eth0 (the sole virtual network interface), but this doesn't seem to be the case.

How can I just disable the firewall completely, or failing that, make port 8234 accessible to the outside world?

share|improve this question

5 Answers 5

up vote 1 down vote accepted

Your webserver is bound to localhost, only.

Make sure your webserver is listening on an IP address other than localhost (127.0.0.1) or link-local (169.254.*.*)

netstat -tl will help

share|improve this answer
    
Thanks, this was it! –  Mark Bell Jul 17 '11 at 17:24

The system-config-securitylevel-tui application provides VERY limited control over the host firewall. If you want to disable the firewall completely you should do:

chkconfig iptables off
service iptables stop

That will stop the firewall from starting at runlevel changes, and shut it down if it's currently running.

To allow access to your single port

iptables -A INPUT -p tcp  -m tcp --dport 8234 -j ACCEPT
service iptables save
share|improve this answer
    
The guy could also have enter the actual port in the screen under "other ports" with: tcp:8234 –  Rilindo Jul 13 '11 at 17:01
    
@Rilindo Fair point. TBH, since I haven't used the config tool in anything approaching recent memory I didn't actually think of it. –  Scott Pack Jul 13 '11 at 17:05
    
But you are right it is fairly limited - you can open or close ports, but you can't do nat or significant filtering based on protocols or source/destination . Either you will need to do by hand or use the Red Hat's firewall configurator (in RHEL6, at least). –  Rilindo Jul 13 '11 at 17:46

You shouldn't need to customize the firewall if it's disabled. I believe you can also turn off the firewall once installation has completed; I don't have a CentOS system handy to look it up but the Internet seems to recommend

service iptables save
service iptables stop
chkconfig iptables off

This will save your rules, and disable the firewall on subsequent boot. There's probably also a graphical tool, this being Red Hat we're talking about. ;)

A firewall is a decent thing to have. You would add 8234:tcp to the other ports field (and/or udp if your service needs it).

Running the iptables command provided by @Lucas will work but doesn't disable the firewall, just allows all traffic. In which case, there's not too much point in leaving the firewall running.

share|improve this answer
iptables -P INPUT ACCEPT

as root

share|improve this answer
    
This doesn't seem to have made any difference. Do I need to restart the firewall service, or anything else? –  Mark Bell Jul 13 '11 at 14:38
    
@Mark IIRC restarting the firewall removes any custom settings, so no. But if this doesn't work, then the firewall isn't the issue here –  TheLQ Jul 13 '11 at 14:44
    
@TheLQ it does unless you save them first, when they get stored in /etc/sysconfig/iptables or somewhere thereabouts. The distro-approved method is to use commands to modify the config then save the running config. –  Michael Lowman Jul 13 '11 at 14:48

Use the following command to see what port your web server is listening on

(I am assuming that you are using apache)

netstat -an | grep httpd

Make sure that it is bound to your public IP and not just the local loopback

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.