Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

seems it doesn't specify explicitly that 7777 port is not allowed to be accessed from outside, but the issue is that i can visit this host through https:// ... :7777 only when i close iptables service.

so my question is that which rule in the following rule set just forbid me to access my host using https:// ... :7777?

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
RH-Firewall-1-INPUT  all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            icmp any 
ACCEPT     esp  --  anywhere             anywhere            
ACCEPT     ah   --  anywhere             anywhere            
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
share|improve this question

1 Answer 1

up vote 2 down vote accepted

You have a REJECT rule at the end of your INPUT chain:

REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited
share|improve this answer
    
but what is the relation of https requests to icmp protocol, i think https only have something to do with tcp:( –  giantforest Aug 23 '12 at 15:56
1  
You're correct that https is TCP, but that last column doesn't specify to reject traffic that is ICMP, it specifies to reject the traffic and notify the remote host that it's been rejected by sending an ICMP Host Prohibited message back to the source. The second column 'all' is where you specify what protocol to act on. –  Kyle Smith Aug 23 '12 at 16:13
    
seem reject all is kind of strong rule, so every time i install new software which should open new port, i should modify the iptables rules which is a bit boring, right? –  giantforest Aug 24 '12 at 0:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.