Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to do the flask tutorial in python, which runs a server on port 5000. I can connect to my (remote) server when I stop iptables, but when I have iptables running, the connection times out.

I can't figure which of the rules is preventing my connection.

# /sbin/iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:commplex-main
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:commplex-main

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:distinct
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

So when I stop iptables, I can connect. When it's running, I can't connect. This suggests it's the firewall doing the blocking, right?

Any thoughts on where to start?

share|improve this question
add comment

1 Answer 1

up vote 3 down vote accepted

It looks like you used something like

iptables -A INPUT ...

to add your rules for port 5000 to your firewall configuration.

Note that the first thing your INPUT chain does is send all packets to the RH-Firewall-1-INPUT chain. The last thing this does is

REJECT     all  --  anywhere     anywhere     reject-with icmp-host-prohibited

Ipatbles processes packets and acts upon the rules in the order then appear in the list and the first wins. This means that packets never reach your

tcp  --  anywhere             anywhere            state NEW tcp dpt:commplex-main
tcp  --  anywhere             anywhere            tcp dpt:commplex-main

rules at the end of the INPUT chain.

You need to add the rules for port 5000 to the INPUT or RH-Firewall-1-INPUT chain using the -I (insert) option

iptables -I RH-Firewall-1-INPUT ...

because using -A (add) puts the rules at the end of the chain whereas -I puts them after the provided line-number or at line 1 if not --lune-number is provided.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.