Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Linux server (CentOS 6.3), where all ports seem to be accessible from inside (when tried from the server), but only SSH is accessible from outside. I would like to allow some other ports, such as 1521 (Oracle), but I cannot get it working.

I tried the following:

iptables -A INPUT -m state --state NEW -p tcp --dport 1521 -j ACCEPT
service iptables save
service iptables restart

but I still get a "Connection timed out" when I do a "telnet 192.168.97.1 1521" from another machine, while I can connect from the server with the same command.

This is what I have in /etc/sysconfig/iptables:

# Generated by iptables-save v1.4.7 on Fri Mar 15 12:13:41 2013
*nat
:PREROUTING ACCEPT [6:1136]
:POSTROUTING ACCEPT [14:878]
:OUTPUT ACCEPT [15:986]
-A POSTROUTING -o em1 -j MASQUERADE
COMMIT
# Completed on Fri Mar 15 12:13:41 2013
# Generated by iptables-save v1.4.7 on Fri Mar 15 12:13:41 2013
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [45:3812]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1521 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Fri Mar 15 12:13:41 2013

(The line -A POSTROUTING -o em1 -j MASQUERADE is there because previously I also tried to install a PPTP server as described here)

share|improve this question

2 Answers 2

up vote 4 down vote accepted

The order in which the directives appear is important. The first match wins.

So your problem is:

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1521 -j ACCEPT

Thus you never allow traffic to port 1521.

To fix the problem, simply reverse the two lines.

share|improve this answer
    
It works, thank you very much! –  lbalazscs Mar 15 '13 at 11:45

You can use the following 2 options: ( I assume that you use Red Hat or CentOS Linux).

Option 1:
In a root shell execute the command:

iptables -L --line-numbers

That will show you the chains and the rules that are applied in each chain with line numbers. For example, in one of my servers the output is:

iptables -L --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  anywhere             anywhere
Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination
1    ACCEPT     all  --  anywhere             anywhere
2    ACCEPT     icmp --  anywhere             anywhere            icmp any
3    ACCEPT     esp  --  anywhere             anywhere
4    ACCEPT     ah   --  anywhere             anywhere
5    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
6    ACCEPT     udp  --  anywhere             anywhere            state NEW udp    dpt:snmp
....
14   DROP       all  --  anywhere             anywhere

So, in order to setup your rule, I would execute the following commands:

iptables -I 7 INPUT -m state --state NEW -p tcp --dport 1521 -j ACCEPT
service iptables save
service iptables restart

Using the -I 7 instead of the -A I instructed iptables to add a new rule at line 7, and push down all other rules. Note that in my case I could use any line number from 7-14.


Option 2:

Edit the file /etc/sysconfig/iptables, find the last entry before the "DROP" and add the rule there, save the file and reload iptables.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.