I use iptables to open port 80 for HTTP on CentOS 6.4 I usually use vim to edit the /etc/sysconfig/iptables But this time I use /sbin/iptables command.
# /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
# service iptables save
# service iptables restart
When I list the rules I can see http like this:
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http
But I can not connect to web server from other machine I checked the iptables file and I see the content like this:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [88:9264]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
I had to manual put the line:
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
before
-A INPUT -j REJECT --reject-with icmp-host-prohibited
and then when I restart iptables service. It worked!
So how can append new rules in a right way? Thanks!