Today I'm facing a strange problem. Some days ago I configured Iptables. I opened port 80,1000 and some others port. Today I need to open port 25 for mail system. I have added the rule in configuration file of iptables, but for some reason the port stay closed. I also tried to restart the system, but still port 25 remains closed. I also tried to disable iptables... and port 25 remains closed. I have no idea of what's happening...
I'm on Centos 7
EDIT: Of course, the port I opened some days ago are still opened
EDIT 2: Here's the result of the command iptables -L -n -v
Chain INPUT (policy DROP 1173 packets, 75761 bytes)
pkts bytes target prot opt in out source destination
19620 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19620 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19620 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19633 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19633 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19633 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19633 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19633 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19633 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19633 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
19633 3555K f2b-default tcp -- * * 0.0.0.0/0 0.0.0.0/0
15679 3181K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
2849 353K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21
61 3524 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:50492
140 7600 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
2 104 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:995
2 104 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:993
183 9889 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:10000
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpts:1024:65535 state ESTABLISHED
18543 597K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 35337 packets, 4328K bytes)
pkts bytes target prot opt in out source destination
1824 797K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpts:1024:65535 state RELATED,ESTABLISHED
Chain f2b-default (11 references)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- * * 111.200.39.31 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- * * 51.254.203.77 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- * * 223.100.157.212 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- * * 203.162.15.233 0.0.0.0/0 reject-with icmp-port-unreachable
216K 39M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
iptables -L -n -v
- @ArulSelvan,-v
includes vital information like restrictions on interface, without which rules cannot be meaningfully examined.-v
comment above. I allow port 80,443 from anywhere to my host. Here is the output ofiptables -L -n |egrep '80|443'
where you can see the rule. I agree adding-v
is good but not necessary in this case.# iptables -L -n |egrep '80|443'
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
-v
. Consider the ruleiptables -I INPUT -i tun+ -p tcp --dport 80 -j ACCEPT
. Without-v
, this will look identical to your blanket permit on inbound HTTP traffic; but it won't work like that in practice (it permits only inbound HTTP traffic from logical interfaces normally associated with established routed OpenVPN connections). When analysing possible rule failures,-v
is always needed.