Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use iptables to open port 80 for HTTP on CentOS 6.4 I usually use vim to edit the /etc/sysconfig/iptables But this time I use /sbin/iptables command.

# /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
# service iptables save
# service iptables restart

When I list the rules I can see http like this:

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http 

But I can not connect to web server from other machine I checked the iptables file and I see the content like this:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [88:9264]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

I had to manual put the line:

-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

before

-A INPUT -j REJECT --reject-with icmp-host-prohibited

and then when I restart iptables service. It worked!

So how can append new rules in a right way? Thanks!

share|improve this question
add comment

1 Answer

up vote 8 down vote accepted

The -A command to iptables simply "appends" a rule. So if you're existing ruleset looks like this:

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

And you run:

# /sbin/iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

Then of course this will end up after the REJECT rule (because you told it to append the rule to the existing rulset). You have a few choices:

  1. You can simply edit /etc/sysconfig/iptables by hand, insert the rules you want, and run service iptables restart.
  2. You can use the lokkit tool to modify the firewall instead. E.g., lokkit -p 80:tcp. This will automatically update /etc/sysconfig/iptables as well as the active firewall.
  3. You can use the -I <num> flag to iptables to insert the rule at the specified position in the list. The --line-numbers flag can be useful for figuring out what <num> should be. You'll need to run service iptables save after making changes this way.

If you really want to be able to do this sort of thing using just append commands, you'll need to perform a little setup first. Create a new chain (called, maybe, allow_services):

iptables -N allow_services

And add a rule to your INPUT chain in the appropriate place that jumps to this new chain:

iptables -I INPUT 5 -j allow_services

And from that point on, you can simply append new services to the allow_services chain:

iptables -A allow_services -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

Assuming that you place your jump rule (the -j option) before the final REJECT this will do what you seem to be asking.

share|improve this answer
    
Woah so except specify the line number to append then there is no way to append the rule without manual check? –  tungns Jul 24 '13 at 2:57
    
I'm not sure I understand your question. The "append" flag (-A) simply appends a rule to the end of your ruleset. If you need to place the rule somewhere besides the end of your ruleset, you're no longer appending, so you need a different solution. –  larsks Jul 24 '13 at 3:20
    
Sorry because my explanation. Follow you guide I found that I have to specific line number to insert the rule like this: /sbin/iptables -I INPUT 5 -m state --state NEW -p tcp --dport 80 -j ACCEPT then it works. But there is no way to config using only iptables without specify the line number to insert? –  tungns Jul 24 '13 at 3:31
    
I think that the options I had previously presented are all viable alternatives (I am particularly fond of just hand-editing /etc/sysconfig/iptables), but I've updated my answer with an alternative that will maybe get you where you want to be. –  larsks Jul 24 '13 at 3:37
    
Or you can just re-run system-config-firewall-tui. –  Michael Hampton Jul 24 '13 at 3:39
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.