19

I'm new to opening up ports in CentOS. I need to open up tcp port 8080 and have installed/ran nmap to find it is not open already. I've been reading about the iptables command, I have v1.3.5 installed but I really don't know where to start with it regarding opening up this port.

I'd appreciate a code sample or at least a link to a guide to opening this port using iptables (or any other good method.)

Thank you.

26

I always like to add a comment and limit scope in my firewall rules.

If I was opening up tcp port 8080 from everywhere (no scope limiting needed) for Tomcat I would run the following command

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT -m comment --comment "Tomcat Server port"

Then make sure to save your running iptables config so that it goes into effect after the next restart

service iptables save 

Note: you'll need to have the comment module installed for that part to work, probably a good chance that it is if you are running Centos 5 or 6

P.S.

If you want to limit scope you can use the -s flag. Here is an example on how to limit traffic to 8080 from the 192.168.1 subnet

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -s 192.168.1.0/24 -j ACCEPT -m comment --comment "Tomcat Server port"
  • I performed the first statement you listed, saved it, and restarted the server. I can't seem to see the 8080 opened using nmap? – user1062058 Dec 17 '11 at 2:01
  • 10
    In case anbody has experienced that the port didn't open after giving this command, you may have a target REJECT already existing in the INPUT chain and your new rule only added after that (I had this problem) which never reaches. So you have to insert your rule before the REJECT. First use iptables -L -n --line-numbers to display all rules with numbers and then use iptables -I INPUT <n> instead of iptables -A INPUT in the command in the answer (where <n> was the number of the REJECT target). This will insert your new rule above the REJECT and it should work. – prajeesh kumar Sep 11 '12 at 4:35
  • @prajeesh what is the command to move the order of the REJECT rule down? Do i just delete it then re append it below? – Nassign Jul 7 '15 at 1:26
  • @Nassign Yep, delete that REJECT then insert it at the position you want – prajeesh kumar Jul 7 '15 at 13:49
39

For CentOS 7:

firewall-cmd --permanent --add-port=8080/tcp
firewall-cmd --reload

See the documentation for FirewallD.

  • Seems FirewallD should be running for these commands, otherwise its not working. – unibasil Jan 25 '16 at 3:14
  • 1
    @unibasil If the firewall daemon is not running, then you don't have a firewall at all, so you don't need to "open up" any ports at all, they're already open. – Sergiu Dumitriu Jan 25 '16 at 4:17
  • how to close it again? – kiltek Feb 15 '16 at 10:30
  • 2
    @kiltek --remove-port does the opposite of --add-port. – Sergiu Dumitriu Feb 15 '16 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.