1

I have iptables on my CentOS 6.2 machine. Installed and configured apache2 with SSL support and works with iptables disabled.

When i add the following rule:

iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

When i save this and restart iptables, the connection in the browser times out... Any suggestions?

full script

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [19:1748]
-A INPUT -p tcp -m tcp --dport 389 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
Improve this question
0

3 Answers 3

Reset to default
1

You added this rule to the end of your iptables.

If you have a:

 iptables -A INPUT -j DROP

before this, the packets are dropped, before evaluating your rule. You should try putting the rule to the top (inserting, not appending):

iptables -I INPUT -p tcp -m tcp --dport 443 -j ACCEPT   # -I instead of -A

Also, iptables are applied immediately, so it should work without saving/restarting restarting.

Improve this answer
3
  • There is no drop in full script; I'll add the full script to post
    – ferdyh
    Jun 4, 2012 at 14:56
  • don't add a drop, if you don't need it. What is the policy? (iptables -L) on INPUT table? If the policy is ACCEPT and no DROP rule, something else is blocking the connections. Also check if apache is actually listening on port 443 (netstat -tulpn | grep LISTEN) (or REJECT insetad of DROP)
    – mulaz
    Jun 4, 2012 at 14:58
  • Ok, guess putting the 443 script line on top of the save file worked
    – ferdyh
    Jun 4, 2012 at 14:59
0 
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

First line: if now rules have been matched yet, reject this packet. REJECT is a terminal rule, so if it is matched nothing after that is evaluated.

Since your 443 is after that, it will never be tested. You need to insert your rule in your script above your rejection line.

iptables -I is used for inserting rules on a live table.

Improve this answer
0

Instead of using iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT to put that rule at the end of the INPUT table, you should use iptables -I INPUT 5 -p tcp -m tcp --dport 443 -j ACCEPT to put it before the "REJECT" rule in the INPUT table.

There is no need to put it as the first entry in the table, just place that rule above the "REJECT" rule is enough. Also, you may prefer to add the option -m state --state NEW to your command so that it will only match new connections.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.