Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use ManageWP to backup WordPress on my VPS then upload that to Amazon S3. It's failing with "Error 503 Service Unavailable" at the upload part when I have iptables running. When the iptables service is stopped, the AWS upload works just fine.

In the past I'd have used a shiny Ubuntu app for this, but now I'm on a CentOS VPS, I'm not sure how to do this from the console. I read iptables: find out what packet is blocked by which rule? but unfortunately most of it went over my head.

What command can I use to see what connections are being made from my VPS to/from Amazon AWS when iptables is off, that are being blocked when iptables is on?

# iptables -L -v -n
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
22496   11M acctboth   all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2096
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2095
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2083
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2082
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2087
    5   430 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2086
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
  639  131K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
   81  5236 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:465
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:587
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:993
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:143
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:995
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:110
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:25
   96  6076 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:990
18974 1719K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpts:49152:65535
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:20
   17  1235 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21
 2568 9070K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
   43  2780 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
   73 11665 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:993
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:2078
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:53
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:21
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:2082
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:443
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:2077
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:26
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:8080
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:143
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:995
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:110
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:25
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:2086
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:2087
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:2095
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:465
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:2096
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:3306
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:2083
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:53

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 9269 packets, 60M bytes)
 pkts bytes target     prot opt in     out     source               destination
 9269   60M acctboth   all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain acctboth (2 references)
 pkts bytes target     prot opt in     out     source               destination
 5597   50M            tcp  --  !lo    *       XXX.XX.XX.86         0.0.0.0/0           tcp dpt:80
18611 1009K            tcp  --  !lo    *       0.0.0.0/0            XXX.XX.XX.86        tcp spt:80
    0     0            tcp  --  !lo    *       XXX.XX.XX.86         0.0.0.0/0           tcp dpt:25
    0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XX.XX.86        tcp spt:25
    0     0            tcp  --  !lo    *       XXX.XX.XX.86         0.0.0.0/0           tcp dpt:110
    0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XX.XX.86        tcp spt:110
    2   160            icmp --  !lo    *       XXX.XX.XX.86         0.0.0.0/0
    0     0            icmp --  !lo    *       0.0.0.0/0            XXX.XX.XX.86
 6696   51M            tcp  --  !lo    *       XXX.XX.XX.86         0.0.0.0/0
19858 1453K            tcp  --  !lo    *       0.0.0.0/0            XXX.XX.XX.86
   20  1666            udp  --  !lo    *       XXX.XX.XX.86         0.0.0.0/0
   20  3925            udp  --  !lo    *       0.0.0.0/0            XXX.XX.XX.86
 6718   51M            all  --  !lo    *       XXX.XX.XX.86         0.0.0.0/0
19878 1457K            all  --  !lo    *       0.0.0.0/0            XXX.XX.XX.86
    0     0            tcp  --  !lo    *       XXX.XX.XX.87         0.0.0.0/0           tcp dpt:80
    0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XX.XX.87        tcp spt:80
    0     0            tcp  --  !lo    *       XXX.XX.XX.87         0.0.0.0/0           tcp dpt:25
    0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XX.XX.87        tcp spt:25
    0     0            tcp  --  !lo    *       XXX.XX.XX.87         0.0.0.0/0           tcp dpt:110
    0     0            tcp  --  !lo    *       0.0.0.0/0            XXX.XX.XX.87        tcp spt:110
    4   320            icmp --  !lo    *       XXX.XX.XX.87         0.0.0.0/0
    0     0            icmp --  !lo    *       0.0.0.0/0            XXX.XX.XX.87
    0     0            tcp  --  !lo    *       XXX.XX.XX.87         0.0.0.0/0
    4   208            tcp  --  !lo    *       0.0.0.0/0            XXX.XX.XX.87
    6  1067            udp  --  !lo    *       XXX.XX.XX.87         0.0.0.0/0
    6   433            udp  --  !lo    *       0.0.0.0/0            XXX.XX.XX.87
   10  1387            all  --  !lo    *       XXX.XX.XX.87         0.0.0.0/0
   10   641            all  --  !lo    *       0.0.0.0/0            XXX.XX.XX.87
28599   61M            all  --  !lo    *       0.0.0.0/0            0.0.0.0/0

And the iptables-save output:

# iptables-save
# Generated by iptables-save v1.4.7 on Fri Jun 15 00:33:26 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [12433:68011185]
:acctboth - [0:0]
-A INPUT -j acctboth
-A INPUT -p tcp -m tcp --dport 2096 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2095 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2083 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2082 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2087 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2086 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 990 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 49152:65535 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m state --state NEW -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2078 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2082 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2077 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 26 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 995 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2086 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2087 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2095 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2096 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2083 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -j acctboth
-A acctboth -s XXX.XX.XX.86/32 ! -i lo -p tcp -m tcp --dport 80
-A acctboth -d XXX.XX.XX.86/32 ! -i lo -p tcp -m tcp --sport 80
-A acctboth -s XXX.XX.XX.86/32 ! -i lo -p tcp -m tcp --dport 25
-A acctboth -d XXX.XX.XX.86/32 ! -i lo -p tcp -m tcp --sport 25
-A acctboth -s XXX.XX.XX.86/32 ! -i lo -p tcp -m tcp --dport 110
-A acctboth -d XXX.XX.XX.86/32 ! -i lo -p tcp -m tcp --sport 110
-A acctboth -s XXX.XX.XX.86/32 ! -i lo -p icmp
-A acctboth -d XXX.XX.XX.86/32 ! -i lo -p icmp
-A acctboth -s XXX.XX.XX.86/32 ! -i lo -p tcp
-A acctboth -d XXX.XX.XX.86/32 ! -i lo -p tcp
-A acctboth -s XXX.XX.XX.86/32 ! -i lo -p udp
-A acctboth -d XXX.XX.XX.86/32 ! -i lo -p udp
-A acctboth -s XXX.XX.XX.86/32 ! -i lo
-A acctboth -d XXX.XX.XX.86/32 ! -i lo
-A acctboth -s XXX.XX.XX.87/32 ! -i lo -p tcp -m tcp --dport 80
-A acctboth -d XXX.XX.XX.87/32 ! -i lo -p tcp -m tcp --sport 80
-A acctboth -s XXX.XX.XX.87/32 ! -i lo -p tcp -m tcp --dport 25
-A acctboth -d XXX.XX.XX.87/32 ! -i lo -p tcp -m tcp --sport 25
-A acctboth -s XXX.XX.XX.87/32 ! -i lo -p tcp -m tcp --dport 110
-A acctboth -d XXX.XX.XX.87/32 ! -i lo -p tcp -m tcp --sport 110
-A acctboth -s XXX.XX.XX.87/32 ! -i lo -p icmp
-A acctboth -d XXX.XX.XX.87/32 ! -i lo -p icmp
-A acctboth -s XXX.XX.XX.87/32 ! -i lo -p tcp
-A acctboth -d XXX.XX.XX.87/32 ! -i lo -p tcp
-A acctboth -s XXX.XX.XX.87/32 ! -i lo -p udp
-A acctboth -d XXX.XX.XX.87/32 ! -i lo -p udp
-A acctboth -s XXX.XX.XX.87/32 ! -i lo
-A acctboth -d XXX.XX.XX.87/32 ! -i lo
-A acctboth ! -i lo
COMMIT
# Completed on Fri Jun 15 00:33:26 2012
share|improve this question
    
Well, it's likely something is blocking outbound connections on 443/tcp. Paste your iptables rules, please. –  EEAA Jun 14 '12 at 14:25
    
I tried iptables -I INPUT -j LOG --log-prefix "iptables denied: " --log-level 7 but nothing came up. –  harvest316 Jun 14 '12 at 14:27
add comment

1 Answer

As the referenced post says, you can use iptables counters to see which rule are hit when your send a new request. The command to use is: iptables -L -n -v.

Also, you can use any packet capturing tool (like wireshark or tcpdump) to see the packets that are hitting your firewall. You may mistakenly opened/closed the wrong port(s).

To get better help, you can post our iptables rules using iptables-save.

share|improve this answer
    
I've added the output of both. I'm getting Error 503 Service Unavailable. Does that help? –  harvest316 Jun 14 '12 at 14:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.