Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is related to my previous question. Not really a need to read it, but I'm running a Fedora 15 webserver and I've been trying to get Apache running correctly.

I've got an incorrectly configured firewall for a webserver at the moment - it's blocking inbound requests on port 80. I found it was a problem with iptables, so ran a command to correct it:

/sbin/iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT

That didn't do anything. Both before and after I restarted the iptables service, I got no response from the server.

The next suggestion on the page I'm using to fix this is to append these lines to /etc/system/iptables, so I tried that:

-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT

But iptables wouldn't even start after I added these lines. so I changed them to look more like the rest of my config file. So now the file in its entirety looks like this:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited


-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT


-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

The lines I added are the ones separated in the middle. Alas, this didn't work either. And I am making sure to restart the iptables service after each thing I try.

So, how could I fix this to allow my webserver to act correctly, being able to serve websites on port 80 (and 443)? I do need to leave iptables enabled, right?

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

If you deny all traffic in the line before your addition, this is the cause. Move the line behind your edit (or vice versa) and it will probably work.

And then a tip: Playing with firewalls on a live system to learn is a bad idea.

share|improve this answer
    
unless you have serial console access to the system :-) –  Alpha01 Oct 7 '11 at 21:54
1  
or unless you have a cron job that flushes the rules regularly. –  mailq Oct 7 '11 at 21:56
    
Flushing the rules is not completely reliable since the chain policies will still be intact. I've already been bitten by this technique. –  Alpha01 Oct 7 '11 at 21:59
    
@Alpha01 Good point. But it only should point out an alternative. –  mailq Oct 7 '11 at 22:03
    
Forgive my ignorance, but why is it such a terrible idea? And what exactly does it mean to flush the rules? And what are chain policies? Obviously I'm no sysadmin, I tend to stay in the frontend. I am a Linux enthusiast, though, so I know my way around reasonably well. Oh, and it worked, by the way. Thanks! –  TreyK Oct 7 '11 at 22:11
show 7 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.