1

I have installed CentOS 6 but I'm only able to open Apache2 to outside by turning off the firewall.

Can somebody give me a clue on how I can open apache2 to the outside without turning off the firewall?

UPDATE:

My iptables configuration is the following:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
COMMIT

This machine has the ip "192.168.59.142" and I need to access it the apache via another machine on my network.

UPDATE2:

The solution is to add this rule in "/etc/sysconfig/iptables" and then restart the iptables

-I INPUT -d 192.168.59.142 -p tcp --dport 80 -j ACCEPT
1
  • Do you mean you only want to give access to Apache to the machine with IP address 192.168.59.142?
    – dunxd
    Sep 26, 2011 at 10:00

4 Answers 4

4

This should work

iptables -I INPUT -p tcp --dport 80 -j ACCEPT

the -I will insert the new rule into the beginning of the table. Using -A it will be appended to the end of the table and your blanket REJECT rule will take precedence as iptables works from the top to bottom through the rules and the first one to match wins.

Looking at the configuration you have posted if you moved the

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

above

-A INPUT -j REJECT --reject-with icmp-host-prohibited

this would also work. Restart your firewall with

sudo /sbin/service iptables restart
0
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
1
  • Hi Quanta, thank you for the reply. But it is not working. The access from outside is not possible. Any clue? I must to restar the network after adding this iptables rule?
    – André
    Sep 26, 2011 at 8:18
0

The solution is to add this rule in "/etc/sysconfig/iptables" and then restart the iptables

-I INPUT -d 192.168.59.142 -p tcp --dport 80 -j ACCEPT
1
  • If 192.168.59.142 is the local machine then you probably don't need the -d 192.168.59.142 clause.
    – user9517
    Sep 26, 2011 at 9:29
0

As an alternative, CentOS also has the configuration tool system-config-firewall, which makes it very easy to open a port for a web server.

In the ncurses interface, select 'Customize' and set the checkmark for 'WWW (HTTP)'.

On my CentOS 6.4 system, it added the following rule to /etc/sysconfig/iptables:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .