Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

The company I host with (Softlayer) requires me to open up port ranges 48000 to 48020 for their monitoring service.

From ifconfig, these are my interfaces:

eth0      Link encap:Ethernet  HWaddr 06:3F:74:F6:7F:0C
          inet addr:10.54.12.130
          ...

eth1      Link encap:Ethernet  HWaddr 06:0C:1E:65:0E:A8
          inet addr:50.23.75.242
          ....

These are my current iptables rules:

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all  --  anywhere             anywhere
2    REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable
3    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
4    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http
5    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
6    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ici
7    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all  --  anywhere             anywhere

I've tried this iptables command: iptables -I INPUT 7 -i eth0 -p tcp -s 10.54.12.130 --dport 48000:48020 -j ACCEPT

Which results in this:

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all  --  anywhere             anywhere
2    REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable
3    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
4    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http
5    ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
6    ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ici
7    ACCEPT     tcp  --  10.54.12.130         anywhere            tcp dpts:nimcontroller:48020
8    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all  --  anywhere             anywhere

But the Nimsoft-monitor-testing tool that Softlayer provides shows that it's not able to connect.

What am I doing wrong?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

10.54.12.130 is your internal IP address, not the internal IP address of Softlayer's Nimsoft server. You are only allowing connections to those ports from your own IP! That's why it's not working.

To resolve the issue, change the source IP address to the Nimsoft server IP address given to you by Softlayer, or if it's a trusted management network, you may omit the source IP entirely. Softlayer themselves recommend you use a source of 10.0.0.0/8. So the rule would look like:

-A INPUT -i eth0 -s 10.0.0.0/8 -p tcp -m state --state NEW --dports 48000:48020 -j ACCEPT
share|improve this answer
    
Or replace -A INPUT with -R INPUT 7 to replace the existing rule. –  Michael Hampton May 20 '13 at 23:26
    
Thank you! That fixed it. I was suspicious of how I had listed my IP, but I wasn't sure what to do otherwise. –  skyler May 21 '13 at 0:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.