Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have iptables on my CentOS 6.2 machine. Installed and configured apache2 with SSL support and works with iptables disabled.

When i add the following rule:

iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

When i save this and restart iptables, the connection in the browser times out... Any suggestions?

full script

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [19:1748]
-A INPUT -p tcp -m tcp --dport 389 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
share|improve this question

3 Answers 3

You added this rule to the end of your iptables.

If you have a:

 iptables -A INPUT -j DROP

before this, the packets are dropped, before evaluating your rule. You should try putting the rule to the top (inserting, not appending):

iptables -I INPUT -p tcp -m tcp --dport 443 -j ACCEPT   # -I instead of -A

Also, iptables are applied immediately, so it should work without saving/restarting restarting.

share|improve this answer
    
There is no drop in full script; I'll add the full script to post –  Ferdy Jun 4 '12 at 14:56
    
don't add a drop, if you don't need it. What is the policy? (iptables -L) on INPUT table? If the policy is ACCEPT and no DROP rule, something else is blocking the connections. Also check if apache is actually listening on port 443 (netstat -tulpn | grep LISTEN) (or REJECT insetad of DROP) –  mulaz Jun 4 '12 at 14:58
    
Ok, guess putting the 443 script line on top of the save file worked –  Ferdy Jun 4 '12 at 14:59
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

First line: if now rules have been matched yet, reject this packet. REJECT is a terminal rule, so if it is matched nothing after that is evaluated.

Since your 443 is after that, it will never be tested. You need to insert your rule in your script above your rejection line.

iptables -I is used for inserting rules on a live table.

share|improve this answer

Instead of using iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT to put that rule at the end of the INPUT table, you should use iptables -I INPUT 5 -p tcp -m tcp --dport 443 -j ACCEPT to put it before the "REJECT" rule in the INPUT table.

There is no need to put it as the first entry in the table, just place that rule above the "REJECT" rule is enough. Also, you may prefer to add the option -m state --state NEW to your command so that it will only match new connections.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.