Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Have a centos 6.3 box running on Parallels

and I'm trying to open port 80 to be accesible from outside

tried the gui solution from this post and it works, but I need to get it done from a script.

Tried to do this:

sudo /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
sudo /sbin/iptables-save
sudo /sbin/service iptables restart

This creates exactly the same iptables entries as the GUI tool except it does not work:

$ telnet xx.xxx.xx.xx 80
Trying xx.xxx.xx.xx...
telnet: connect to address xx.xxx.xx.xx: Connection refused
telnet: Unable to connect to remote host

UPDATE:

$ netstat -ntlp
(No info could be read for "-p": geteuid()=500 but you should be root.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State              PID/Program name   
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      -                   
tcp        0      0 127.0.0.1:6379              0.0.0.0:*                   LISTEN      -                   
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      -                   
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      -                   
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      -                   
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      -                   
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      -                   
tcp        0      0 0.0.0.0:37439               0.0.0.0:*                   LISTEN      -                   
tcp        0      0 :::111                      :::*                        LISTEN      -                   
tcp        0      0 :::22                       :::*                        LISTEN      -                   
tcp        0      0 ::1:631                     :::*                        LISTEN      -                   
tcp        0      0 :::60472                    :::*                        LISTEN      -   

$ sudo cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Wed Dec 12 18:04:25 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5:640]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -j REJECT --reject-with icmp-host-prohibited 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT 
-A FORWARD -j REJECT --reject-with icmp-host-prohibited 
COMMIT
# Completed on Wed Dec 12 18:04:25 2012
share|improve this question
    
Maybe something is blocking it before it gets to this rule? Could you post other rules that are listed before this one? ( cat /etc/sysconfig/iptables ) –  rchukh Dec 19 '12 at 9:16
    
does telnet 127.0.0.1 80 works as expected from the centos box? What's the output of netstat -ntlp? –  coincoin Dec 19 '12 at 9:19
    
telnet 127.0.0.1 80 works from inside the centos box –  Hugo Dec 19 '12 at 10:28

3 Answers 3

up vote 3 down vote accepted

I would say your rule is at the end of your INPUT iptables list. Try this iptables -I INPUT 5 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT and then run service iptables save. The A in your command appends the rule to the current INPUT list. This is after a rule that may have an explicit REJECT. The I in my command, places the rule in a line position, in this case line 5. Which should be BEFORE the default reject rule. Rules in IPTABLES work from top down and if a rule is match, the firewall applies the rule to the connection. I use this -iptables-rules-examples- really helpful

share|improve this answer

Rule matching going from up to down. So iptables make actions when first match. You have:

-A INPUT -j REJECT --reject-with icmp-host-prohibited 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

1st rule doesn't have any condition, so there is no packets that could reach 2nd rule.

share|improve this answer

Command service iptables restart don't save your current iptables rules.

Execute service iptables save before restart it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.