9

I use iptables to open port 80 for HTTP on CentOS 6.4 I usually use vim to edit the /etc/sysconfig/iptables But this time I use /sbin/iptables command.

# /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
# service iptables save
# service iptables restart

When I list the rules I can see http like this:

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http 

But I can not connect to web server from other machine I checked the iptables file and I see the content like this:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [88:9264]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

I had to manual put the line:

-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

before

-A INPUT -j REJECT --reject-with icmp-host-prohibited

and then when I restart iptables service. It worked!

So how can append new rules in a right way? Thanks!

1 Answer 1

19

The -A command to iptables simply "appends" a rule. So if you're existing ruleset looks like this:

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

And you run:

# /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

Then of course this will end up after the REJECT rule (because you told it to append the rule to the existing rulset). You have a few choices:

  1. You can simply edit /etc/sysconfig/iptables by hand, insert the rules you want, and run service iptables restart.
  2. You can use the lokkit tool to modify the firewall instead. E.g., lokkit -p 80:tcp. This will automatically update /etc/sysconfig/iptables as well as the active firewall.
  3. You can use the -I <num> flag to iptables to insert the rule at the specified position in the list. The --line-numbers flag can be useful for figuring out what <num> should be. You'll need to run service iptables save after making changes this way.

If you really want to be able to do this sort of thing using just append commands, you'll need to perform a little setup first. Create a new chain (called, maybe, allow_services):

iptables -N allow_services

And add a rule to your INPUT chain in the appropriate place that jumps to this new chain:

iptables -I INPUT 5 -j allow_services

And from that point on, you can simply append new services to the allow_services chain:

iptables -A allow_services -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

Assuming that you place your jump rule (the -j option) before the final REJECT this will do what you seem to be asking.

8
  • 1
    Woah so except specify the line number to append then there is no way to append the rule without manual check?
    – tungns
    Jul 24, 2013 at 2:57
  • I'm not sure I understand your question. The "append" flag (-A) simply appends a rule to the end of your ruleset. If you need to place the rule somewhere besides the end of your ruleset, you're no longer appending, so you need a different solution.
    – larsks
    Jul 24, 2013 at 3:20
  • Sorry because my explanation. Follow you guide I found that I have to specific line number to insert the rule like this: /sbin/iptables -I INPUT 5 -m state --state NEW -p tcp --dport 80 -j ACCEPT then it works. But there is no way to config using only iptables without specify the line number to insert?
    – tungns
    Jul 24, 2013 at 3:31
  • I think that the options I had previously presented are all viable alternatives (I am particularly fond of just hand-editing /etc/sysconfig/iptables), but I've updated my answer with an alternative that will maybe get you where you want to be.
    – larsks
    Jul 24, 2013 at 3:37
  • 1
    It hasn't been mentioned explicitly yet, but if you use -I without a number, it does the opposite of -A and puts the rule at the very TOP of the chain, rather than the very bottom (effectively, the number defaults to 1 if you omit it)
    – fukawi2
    Jul 24, 2013 at 5:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .