Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am writing a script to open ports based on a textfile, and am having problems opening these ports. For instance, I have tried opening port 18819 by entering the command

/sbin/iptables -A INPUT -m state --state NEW -p tcp --dport 18819 -j ACCEPT

or

/sbin/iptables -A INPUT -p tcp -s 0/0 --sport 1024:65535 -d [myIP] --dport 18819 -m state --state NEW,ESTABLISHED -j ACCEPT

If i enter : iptables --list --numeric Result:

... 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:18819 
...

If i enter: vi /etc/sysconfig/iptables

109 -A INPUT -p tcp -m state --state NEW -m tcp --dport 18819 -j ACCEPT-
110 -A INPUT -p tcp -m state --state NEW -m tcp --dport 7667 -j ACCEPT-
111 -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-
112 -A INPUT -p tcp -m state --state NEW -m tcp --dport 8443 -j ACCEPT-
113 -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT-
114 -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT-
115 -A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT-
116 -A INPUT -p tcp -m state --state NEW -m tcp --dport 10781 -j ACCEPT-
117 -A INPUT -p tcp -m state --state NEW -m tcp --dport 18819 -j ACCEPT-
118 -A INPUT -p tcp -m state --state NEW -m tcp --dport 7667 -j ACCEPT-
119 -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-
120 -A INPUT -p tcp -m state --state NEW -m tcp --dport 8443 -j ACCEPT-
121 -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT-
122 -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT-
123 -A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT-
124 -A INPUT -p tcp -m state --state NEW -m tcp --dport 10781 -j ACCEPT-
125 -A INPUT -p tcp -m state --state NEW -m tcp --dport 18819 -j ACCEPT-

You can see I have entered it numerous times. No matter what, after I do a "service iptables restart" or save, the ports are still appearing to be closed via telnet (from other machines on same network) and closed via port scanning software. Any thoughts?

share|improve this question
    
Is there really a - at the end of each of those lines? –  Michael Hampton Oct 2 '13 at 19:20
    
Sorry- vi shows spaces as a "-" –  kjbradley Oct 2 '13 at 19:39
    
(or it could just be my vim.rc) –  kjbradley Oct 2 '13 at 19:40
    
You're using -A you probably should use -I. –  Iain Oct 2 '13 at 22:15
add comment

2 Answers

You have several problems with your commands.

First of, DELETE all your "filter table" rules and start from scratch: iptables --flush

Then focus only on what you want and do not copy/paste commands from google without knowing what they do:

You want to open port 18819 for incomming connections, the protocol is tcp and the source can be anything, the interface is probably eth0:

iptables -A INPUT -i eth0 -p tcp --dport 18819 -j ACCEPT

Also, don't lock yourself out of the system:

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

Finally close all other ports (run as the last command, anything added after this will be useless).

iptables -A INPUT -j DROP

If you want to go further then read some docs: start here then here then here and off course, read the man page for iptables: man iptables

NOTE: In the first command you were opening the port only for NEW connections, keeping out STABLISHED connections. For the second it shows you are way over your head ;) start simple.

share|improve this answer
    
Tried this solution and it does work (kind of) - DROPing all incoming connections makes any connection to port 18819 unnreachable. I tried opening ranges of for loops and keeping the DROP command without success (1-16000).. Any Ideas why closing all incoming ports makes this fail? –  kjbradley Oct 3 '13 at 21:53
add comment

okay try iptables -F and then try using 'system-config-firewall-tui' to open the desired ports and check if it works. In my experience sometimes, iptables behave weirdly and doesn't work using iptables command. I tried to fix it using 'system-config-firewall-tui'. I guess it might be a bug in RHCE 6.4.

share|improve this answer
    
interesting, I am using 6.4 as well –  kjbradley Oct 3 '13 at 21:51
    
my flow is now: flush open ports close remaining ports save restart –  kjbradley Oct 4 '13 at 14:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.