Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I run the following command on my Ubuntu instance:

$ nmap host

I see that port 443 is open:

Starting Nmap 5.21 ( http://nmap.org ) at 2013-03-19 05:36 PDT
Nmap scan report for [host redacted] (ip address redacted)
Host is up (0.000034s latency).
rDNS record for [ip address redacted]: [host redacted]
Not shown: 995 closed ports
PORT      STATE SERVICE
21/tcp    open  ftp
25/tcp    open  smtp
80/tcp    open  http
443/tcp   open  https
30000/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds

However, I'm not able to telnet to port 443. When I do so, I see the following entry in my syslog

Mar 19 05:39:30 localhost kernel: iptables denied: IN=eth0 OUT= MAC=f2:3c:91:ae:c6:7a:c8:4c:75:f5:d6:3f:08:00 SRC=(ip address redacted) DST=(ip address redacted) LEN=64 TOS=0x00 PREC=0x00 TTL=52 ID=23782 DF PROTO=TCP SPT=53375 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0

And the output of iptables -L --line-numbers ACCEPT chain:

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere            
2    REJECT     all  --  anywhere             127.0.0.0/8         reject-with icmp-port-unreachable 
3    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
4    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
5    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:30000 
6    LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: ' 
7    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 
8    ufw-before-logging-input  all  --  anywhere             anywhere            
9    ufw-before-input  all  --  anywhere             anywhere            
10   ufw-after-input  all  --  anywhere             anywhere            
11   ufw-after-logging-input  all  --  anywhere             anywhere            
12   ufw-reject-input  all  --  anywhere             anywhere            
13   ufw-track-input  all  --  anywhere             anywhere            
14   ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https     

I once tried to use UFW, but now that's disabled and I'm just using iptables. I see that on line 14 I'm accepting packets to port 443, but on line 7 I'm rejecting packets. Is the problem with the positioning of the rule? If so, how can I move it further up the chain? Or is it a problem with the rule itself?

When I view the bash history, I believe this was the rule used:

iptables -A INPUT -p tcp --dport 443 -j ACCEPT

UPDATE:

I just solved this by moving the rule further up the chain, and deleting the rule that was appended:

$ iptables -I INPUT 6 -p tcp --dport 443 -j ACCEPT # add the rule to the 6th position
$ iptables -L
$ iptables -D INPUT 15 # delete line 15
share|improve this question

1 Answer 1

Your rules need to go before the reject line and log line

6    LOG        all  --  anywhere             anywhere            limit: avg 5/min burst 5 LOG level debug prefix `iptables denied: ' 
7    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Should be last. This is because the rules are processed in order and the once it gets a match it doesn't look at any more rules

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.