Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have script for an iptables configuration that seems to be loading successfully. However, I then cannot access my website on port 80 or CPanel and WHM on ports 2087 and 2083 (previously possible). I would appreciate help in debugging the issue with my HTTP traffic.

Note for below: In the output below, does the target acctboth in Chain INPUT with policy DROP mean that any rules in acctboth are dropped? Can I blanket change this, since acctboth are supposed to be accepted?

I'm on a CentOS 5 installation with CPanel/WHM. After installing my iptables configuration, saving, and restarting, this is what iptables -nL outputs (note Chain acctboth was present before my modifications, as it was set by CPanel/WHM):

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0 
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8 
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 11 
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 4 
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 3 
acctboth   all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:21 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:21 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:20 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:20 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2083 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2087 
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
acctboth   all  --  0.0.0.0/0            0.0.0.0/0           

Chain acctboth (2 references)
target     prot opt source               destination         
           tcp  --  [MY_IP_1]            0.0.0.0/0           tcp dpt:80 
           tcp  --  0.0.0.0/0            [MY_IP_1]           tcp spt:80 
           tcp  --  [MY_IP_1]            0.0.0.0/0           tcp dpt:25 
           tcp  --  0.0.0.0/0            [MY_IP_1]           tcp spt:25 
           tcp  --  [MY_IP_1]            0.0.0.0/0           tcp dpt:110 
           tcp  --  0.0.0.0/0            [MY_IP_1]           tcp spt:110 
           icmp --  [MY_IP_1]            0.0.0.0/0           
           icmp --  0.0.0.0/0            [MY_IP_1]           
           tcp  --  [MY_IP_1]            0.0.0.0/0           
           tcp  --  0.0.0.0/0            [MY_IP_1]           
           udp  --  [MY_IP_1]            0.0.0.0/0           
           udp  --  0.0.0.0/0            [MY_IP_1]           
           all  --  [MY_IP_1]            0.0.0.0/0           
           all  --  0.0.0.0/0            [MY_IP_1]           
           tcp  --  [MY_IP_2]            0.0.0.0/0           tcp dpt:80 
           tcp  --  0.0.0.0/0            [MY_IP_2]           tcp spt:80 
           tcp  --  [MY_IP_2]            0.0.0.0/0           tcp dpt:25 
           tcp  --  0.0.0.0/0            [MY_IP_2]           tcp spt:25 
           tcp  --  [MY_IP_2]            0.0.0.0/0           tcp dpt:110 
           tcp  --  0.0.0.0/0            [MY_IP_2]           tcp spt:110 
           icmp --  [MY_IP_2]            0.0.0.0/0           
           icmp --  0.0.0.0/0            [MY_IP_2]           
           tcp  --  [MY_IP_2]            0.0.0.0/0           
           tcp  --  0.0.0.0/0            [MY_IP_2]           
           udp  --  [MY_IP_2]            0.0.0.0/0           
           udp  --  0.0.0.0/0            [MY_IP_2]           
           all  --  [MY_IP_2]            0.0.0.0/0           
           all  --  0.0.0.0/0            [MY_IP_2]           
           all  --  0.0.0.0/0            0.0.0.0/0
share|improve this question
    
its much easier install CSF, so that you can set allow/block ports and ips. Also on installation of CSF, a plugin will be created on whm, which makes it easier to manage from front end. –  Ajo Augustine Feb 21 '12 at 20:52
add comment

1 Answer

up vote 0 down vote accepted

its much easier install CSF, so that you can set allow/block ports and ips. Also on installation of CSF, a plugin will be created on whm, which makes it easier to manage from front end

share|improve this answer
    
Thanks for the idea, I'll take a look at it and will return here with my results. –  garromark Feb 21 '12 at 21:30
    
CSF is much easier to deal with. Thanks. Here: ConfigServer Security & Firewall –  garromark Feb 22 '12 at 0:08
    
absolutely. It has much more features. Please go through /etc/csf/csf.conf to get an idea of its capabilities. –  Ajo Augustine Feb 22 '12 at 0:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.