Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my RHEL 6.2 server, in my /etc/sysconfig/iptables, I have :INPUT ACCEPT [0:0] but I cannot access files through web server on port 80 unless I add a rule like this:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

Please clarify why. Thanks. According to this post, I shouldn't need that additional entry.

share|improve this question
What rules are defined in the output table? – Zoredache Jun 9 '12 at 18:48
up vote 2 down vote accepted

We can only guess as you don't show us the rest of your INPUT rules. My guess is that you have a line like this

-A INPUT -j REJECT --reject-with icmp-host-prohibited

at the end of your input rules. This will reject any packet that arrives there and so your policy (:INPUT ACCEPT)isn't consulted.

share|improve this answer
Yup! That's exactly what it is. I didn't know what that line meant. Here's the full content of iptables file. :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT – Balaji Jun 9 '12 at 23:52
Sorry, I don't know how to paste the iptables content so that it shows on different lines. – Balaji Jun 9 '12 at 23:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.