Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is related to my previous question. Not really a need to read it, but I'm running a Fedora 15 webserver and I've been trying to get Apache running correctly.

I've got an incorrectly configured firewall for a webserver at the moment - it's blocking inbound requests on port 80. I found it was a problem with iptables, so ran a command to correct it:

/sbin/iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT

That didn't do anything. Both before and after I restarted the iptables service, I got no response from the server.

The next suggestion on the page I'm using to fix this is to append these lines to /etc/system/iptables, so I tried that:

-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT

But iptables wouldn't even start after I added these lines. so I changed them to look more like the rest of my config file. So now the file in its entirety looks like this:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

The lines I added are the ones separated in the middle. Alas, this didn't work either. And I am making sure to restart the iptables service after each thing I try.

So, how could I fix this to allow my webserver to act correctly, being able to serve websites on port 80 (and 443)? I do need to leave iptables enabled, right?

share|improve this question
up vote 5 down vote accepted

If you deny all traffic in the line before your addition, this is the cause. Move the line behind your edit (or vice versa) and it will probably work.

And then a tip: Playing with firewalls on a live system to learn is a bad idea.

share|improve this answer
unless you have serial console access to the system :-) – Alpha01 Oct 7 '11 at 21:54
or unless you have a cron job that flushes the rules regularly. – mailq Oct 7 '11 at 21:56
Flushing the rules is not completely reliable since the chain policies will still be intact. I've already been bitten by this technique. – Alpha01 Oct 7 '11 at 21:59
@Alpha01 Good point. But it only should point out an alternative. – mailq Oct 7 '11 at 22:03
Forgive my ignorance, but why is it such a terrible idea? And what exactly does it mean to flush the rules? And what are chain policies? Obviously I'm no sysadmin, I tend to stay in the frontend. I am a Linux enthusiast, though, so I know my way around reasonably well. Oh, and it worked, by the way. Thanks! – TreyK Oct 7 '11 at 22:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.