Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new to opening up ports in CentOS. I need to open up tcp port 8080 and have installed/ran nmap to find it is not open already. I've been reading about the iptables command, I have v1.3.5 installed but I really don't know where to start with it regarding opening up this port.

I'd appreciate a code sample or at least a link to a guide to opening this port using iptables (or any other good method.)

Thank you.

share|improve this question
up vote 20 down vote accepted

I always like to add a comment and limit scope in my firewall rules.

If I was opening up tcp port 8080 from everywhere (no scope limiting needed) for Tomcat I would run the following command

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT -m comment --comment "Tomcat Server port"

Then make sure to save your running iptables config so that it goes into effect after the next restart

service iptables save 

Note: you'll need to have the comment module installed for that part to work, probably a good chance that it is if you are running Centos 5 or 6


If you want to limit scope you can use the -s flag. Here is an example on how to limit traffic to 8080 from the 192.168.1 subnet

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -s -j ACCEPT -m comment --comment "Tomcat Server port"
share|improve this answer
I performed the first statement you listed, saved it, and restarted the server. I can't seem to see the 8080 opened using nmap? – user1062058 Dec 17 '11 at 2:01
In case anbody has experienced that the port didn't open after giving this command, you may have a target REJECT already existing in the INPUT chain and your new rule only added after that (I had this problem) which never reaches. So you have to insert your rule before the REJECT. First use iptables -L -n --line-numbers to display all rules with numbers and then use iptables -I INPUT <n> instead of iptables -A INPUT in the command in the answer (where <n> was the number of the REJECT target). This will insert your new rule above the REJECT and it should work. – prajeesh kumar Sep 11 '12 at 4:35
@prajeesh what is the command to move the order of the REJECT rule down? Do i just delete it then re append it below? – Nassign Jul 7 '15 at 1:26
@Nassign Yep, delete that REJECT then insert it at the position you want – prajeesh kumar Jul 7 '15 at 13:49

For CentOS 7:

firewall-cmd --permanent --add-port=8080/tcp
firewall-cmd --reload

See the documentation for FirewallD.

share|improve this answer
Seems FirewallD should be running for these commands, otherwise its not working. – unibasil Jan 25 at 3:14
@unibasil If the firewall daemon is not running, then you don't have a firewall at all, so you don't need to "open up" any ports at all, they're already open. – Sergiu Dumitriu Jan 25 at 4:17
how to close it again? – kiltek Feb 15 at 10:30
@kiltek --remove-port does the opposite of --add-port. – Sergiu Dumitriu Feb 15 at 14:07

See the CentOS docs: and the wiki:

share|improve this answer
Hi, the wiki seemed to clear things up more than the docs. Would this be a good command ? iptables -A INPUT -p tcp --dport 8080 -j ACCEPT – user1062058 Dec 16 '11 at 23:09
Yes, this is the command. – Stone Dec 17 '11 at 7:24
Link only answer. – Konrad Gajewski Feb 15 at 14:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.