Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My question: How to add a custom iptables rule to accept connection on a certain port?

I'm trying to open port 3500 on my server but failed. I started by using this command: (From http://wiki.centos.org/HowTos/Network/IPTables)

iptables -A INPUT -p tcp --dport 3500 -j ACCEPT

But then I run iptables -L I still do not see the new rules being listed: (My assumption it should include 3500 in the output)

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:rtmp-port 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            icmp any 
ACCEPT     esp  --  anywhere             anywhere            
ACCEPT     ah   --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:snmp 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:snmptrap 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Edit So I try to insert ACCEPT rule to the INPUT chain and my iptables now look like this:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3500 
RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0

But it does not allow me to connect to 3500 from outside. (I can still telnet from inside). When I'm trying to telnet my_host 3500, I get this: telnet: Unable to connect to remote host: Connection refused

Edit 2: My netstat -an | grep "LISTEN " output:

tcp 0 0 127.0.0.1:3500 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:973 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 :::22 :::* LISTEN

Edit 3: I followed lain advise, also have my service bind to 0.0.0.0:3500 instead of 127.0.0.1:3500 and it works.

share|improve this question

migrated from superuser.com Sep 26 '11 at 19:18

This question came from our site for computer enthusiasts and power users.

1  
did you run /sbin/service iptables save or iptables save ? actually, wait, nevermind - you did. that is why all of those rules are under the INPUT chain. Just do what lain said. –  tfitzgerald Sep 26 '11 at 21:52
add comment

1 Answer

up vote 10 down vote accepted

Your rules is listed, rtmp-port is port 3500 according to IANA port/service names. To get a listing of port numbers rather than their service names use the -n switch

iptables -L -n 

You have also use the -A switch to add your rule to the INPUT chain. This has added after the packets have been sent to the RH-Firewall-1-INPUT chain, the last rule of which is a blanket REJECT so packets destined for port 3500 will be REJECTed before they get tested in the INPUT Chain.

You have a couple of possible solutions - use the -I switch to insert your rule to the INPUT chain or the RH-Firewall-1-INPUT chain

iptables -I INPUT -p tcp --dport 3500 -j ACCEPT

or

iptables -I RH-Firewall-1-INPUT -p tcp --dport 3500 -j ACCEPT

You should probably clean up your rules too, you can use

iptables -D INPUT -p tcp --dport 3500 -j ACCEPT

(several times) to delete the existing rules for port 3500 before adding the new rules.

share|improve this answer
    
I followed your advise but still cannot connect. I modified my question to include some details. –  Phuong Nguyen Sep 27 '11 at 14:20
    
Can you confirm that service is running? Try running "telnet localhost 3500" within the server verify? –  Rilindo Sep 27 '11 at 14:34
    
telnet localhost 3500 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. –  Phuong Nguyen Sep 27 '11 at 14:40
    
telnet push.mycustomdomain.com 3500 Trying xxx.xx.xxx.xx... telnet: Unable to connect to remote host: Connection refused –  Phuong Nguyen Sep 27 '11 at 14:41
    
This looks like there is nothing listening on your push.mycustomdomain.com:3500. With an open port and nothing listening I get Connection Refused with a closed port I get No route to host –  Iain Sep 27 '11 at 14:47
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.