Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having some troubles getting a Debian webserver to open up port 80 for HTTP traffic. In my iptables, I opened up port 80 using the following commands:

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p udp --dport 80 -j ACCEPT

Running an iptables -L then showed the following rules:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:www
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:www

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

However, after all of this, I ran nmap -sS and discovered that port 80 still isn't open. Here are the results:

Nmap scan report for localhost (
Host is up (0.0000080s latency).
Not shown: 995 closed ports
22/tcp   open  ssh
25/tcp   open  smtp
111/tcp  open  rpcbind
3306/tcp open  mysql
8080/tcp open  http-proxy

How is it possible for rules to be in place to open a port in iptables but still have that same port closed in Nmap? Does anyone have any ideas?

share|improve this question
Is your web server running? Can you post the output of telnet 80? – Khaled Dec 23 '11 at 16:42
Sure thing! Trying telnet: Unable to connect to remote host: Connection refused – candrews Dec 23 '11 at 16:47
The connection refused error means there is no process listening on the port. Can you post the output of sudo netstat -lnp | grep 80? – Khaled Dec 23 '11 at 16:50
tcp6 0 0 :::8080 :::* LISTEN 30191/apache2 – candrews Dec 23 '11 at 16:52
up vote 5 down vote accepted

From the output of netstat -lnp | grep 80, it seems that your apache server is listening on the port 8080 not the default one 80.

Also, the line:

8080/tcp open  http-proxy

from nmap output confirms this fact.

In summary, the port 80 is not open in your machine as apache is listening on 8080 instead.

share|improve this answer
Ahhhh, right you are! It turns out that nmap shows the ports being listened on, not the ports that are currently open. When I switched to port 80 in my apache ports.conf and sites.enabled files, nmap now shows port 80 open. Thank you! – candrews Dec 23 '11 at 16:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.