24

I'm new to opening up ports in CentOS. I need to open up tcp port 8080 and have installed/ran nmap to find it is not open already. I've been reading about the iptables command, I have v1.3.5 installed but I really don't know where to start with it regarding opening up this port.

I'd appreciate a code sample or at least a link to a guide to opening this port using iptables (or any other good method.)

Thank you.

2 Answers 2

27

I always like to add a comment and limit scope in my firewall rules.

If I was opening up tcp port 8080 from everywhere (no scope limiting needed) for Tomcat I would run the following command

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT -m comment --comment "Tomcat Server port"

Then make sure to save your running iptables config so that it goes into effect after the next restart

service iptables save 

Note: you'll need to have the comment module installed for that part to work, probably a good chance that it is if you are running Centos 5 or 6

P.S.

If you want to limit scope you can use the -s flag. Here is an example on how to limit traffic to 8080 from the 192.168.1 subnet

iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -s 192.168.1.0/24 -j ACCEPT -m comment --comment "Tomcat Server port"
4
  • I performed the first statement you listed, saved it, and restarted the server. I can't seem to see the 8080 opened using nmap? Dec 17, 2011 at 2:01
  • 10
    In case anbody has experienced that the port didn't open after giving this command, you may have a target REJECT already existing in the INPUT chain and your new rule only added after that (I had this problem) which never reaches. So you have to insert your rule before the REJECT. First use iptables -L -n --line-numbers to display all rules with numbers and then use iptables -I INPUT <n> instead of iptables -A INPUT in the command in the answer (where <n> was the number of the REJECT target). This will insert your new rule above the REJECT and it should work. Sep 11, 2012 at 4:35
  • @prajeesh what is the command to move the order of the REJECT rule down? Do i just delete it then re append it below?
    – Nassign
    Jul 7, 2015 at 1:26
  • @Nassign Yep, delete that REJECT then insert it at the position you want Jul 7, 2015 at 13:49
50

For CentOS 7:

firewall-cmd --permanent --add-port=8080/tcp
firewall-cmd --reload

See the documentation for FirewallD.

5
  • Seems FirewallD should be running for these commands, otherwise its not working.
    – unibasil
    Jan 25, 2016 at 3:14
  • 1
    @unibasil If the firewall daemon is not running, then you don't have a firewall at all, so you don't need to "open up" any ports at all, they're already open. Jan 25, 2016 at 4:17
  • how to close it again?
    – kiltek
    Feb 15, 2016 at 10:30
  • 2
    @kiltek --remove-port does the opposite of --add-port. Feb 15, 2016 at 14:07
  • Simpler impossible. Thanks.
    – Peppo
    Feb 24, 2020 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.