Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to access to my website on port :8080 But for a reason, I can't :

That's what looks like my iptable -L https://gist.github.com/28e7a48d91e933c6f377

After searching on serverfault, I've just added :

iptables -I INPUT 1 -i lo -p tcp --dport 8080 -j ACCEPT 

With no effet (even after a iptable restart)

How to allow access of the port 8080 please (both locally and externally because of the setting i'm going to put for varnish / apache2) ?

EDIT it seems that after a restart of iptable, the rule of allowing the port 8080 has gone:

after restart.

Thanks.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Allowing a specific port in iptables :

The general form of the rule is :

-A INPUT -i <interface> -p <protocol> --dport <port> -j ACCEPT

-I INPUT <rule no.> -i <interface> -p <protocol> --dport <port> -j ACCEPT

Rule no : The index of the chain where you want to add this rule.

Interface : the interface you wont this rule to apply for, don't specify if you want for all, eg eth0, lo. You may want to specify eth0.

Protocol : which protocol you want it for, tcp/udp. TCP in your case

Port : the port no. you want it to apply to. In your case 8080

Make sure it this rule is before an drop all other packets rule.

The reason you statement is not working is probably because you have specified the interface as lo instead of eth0

To make the rules permanent :

If you just add this rule using the command line, the rule will be discarded when you restart, because the iptables will be loaded again from /etc/sysconfig/iptables. So if you want to make it permanent, you have two choice.

  1. Use iptable-save > /etc/sysconfig/iptables

    This will save the iptables configuration to the iptables file, from which it will be read when you restart your pc. But in case you have manually edited that file to add comments those will be lost.

  2. Manually edit the /etc/sysconfig/iptables file to add this rule to the correct chain. This ensures that comments put in by you are preserved.

PS : You may need to find the location of your iptables file and the interface name and make changes accordingly.

share|improve this answer

you limit your accept rule just to the loopback [by the -i lo part]. to allow world-wide access skip that part and run:

iptables -I INPUT -p tcp --dport 8080 -j ACCEPT

for the best performance your iptables rules should start with:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

and only after that other rules should follow.

share|improve this answer
    
Ok thanks, it's working. If i restart iptables, i need to re-enter both of these lines? –  Tristan Aug 5 '12 at 10:50
    
i dont know how does your firewall script looks like. if it's a bash script - put them at the beginning just after cleaning the iptables rules. –  pQd Aug 5 '12 at 11:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.