Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a newbie at Centos. I need to open a few ports in Centos.

I've googled it a little bit, and found something like this.

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT

But it gives the following error when i try to restart iptables

iptables: Applying firewall rules: iptables-restore: line 13 failed

How can I open ports in Centos 6

share|improve this question
up vote 7 down vote accepted

If you want to open a single port:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT

For multiple, you can use the following instead (or repeat the above line multiple times):

-A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 22,80,143 -j ACCEPT

The reason your line doesn't work is likely because you don't have a chain named 'RH-Firewall-1-INPUT'. CentOS 6 simply uses 'INPUT' as the chain name. You'll note something like the following at the top of the default config, naming the chains that exist:


Just to explain a bit further, the line -A INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT means:

  • -A: append a rule
  • INPUT: to the INPUT chain
  • -m state: use the 'state' module
  • --state NEW: only look for NEW connections (i.e. not those that are previously established/related)
  • -m tcp: use the tcp module
  • -p tcp: look for packets using the TCP protocol
  • --dport 143: look for packets with a destination port of 143
share|improve this answer
thanks for the explanations. I've added the rule and iptables restarted without any errors. But, still when I check the ports from an outside source,, they seem to be closed. Should I do something else to open the ports. – marvin Mar 21 '12 at 7:54
Two possibilities come to mind: a) order matters for iptables rules - if you have this rule after a rule to drop the packets for the chain (e.g. after -A INPUT -j REJECT --reject-with icmp-host-prohibited) then it will never come into play b) A lot of port scans will look for some service actually listening on the external interface on the desired port - so, if you haven't got an IMAP service (e.g. Dovecot) running, then the port may appear closed. – cyberx86 Mar 21 '12 at 10:38

You can solve it by adding :

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

right after the 22 port

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

restart iptables and it should work, at least for me it worked.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.