4

I'm in the process of setting up a Resque server and am having to setup Redis for the first time. When using redis-cli to ping the remote server I get a "No route to host" error, however when I directly ping the remote server it returns ok. As I've never had much dealing with redis or for that matter much behind the scenes on a server I'm not really to sure what to do next.

[root@ss03-dev-worker bin]# redis-cli -h 10.176.x.yyy ping
Could not connect to Redis at 10.176.x.yyy:6379: No route to host

[root@ss03-dev-worker bin]# ping 10.176.x.yyy
PING 10.176.x.yyy (10.176.x.yyy) 56(84) bytes of data.
64 bytes from 10.176.x.yyy: icmp_seq=1 ttl=61 time=2.09 ms
64 bytes from 10.176.x.yyy: icmp_seq=2 ttl=61 time=0.812 ms
64 bytes from 10.176.x.yyy: icmp_seq=3 ttl=61 time=0.508 ms
^C
--- 10.176.x.yyy ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2785ms
rtt min/avg/max/mdev = 0.508/1.139/2.099/0.690 ms

I've made sure that the iptable rules on bother servers allow connections from each.

[root@ss03-dev-worker bin]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
...snip....
ACCEPT     tcp  --  10.176.x.yyy         anywhere            tcp dpt:6379

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-SSH (0 references)
target     prot opt source               destination       

but still can't get redis to connect. Is there anything else I need to implement?

If it makes a different, this is on Rackspace Cloud.

Edit:

The redis conf bind parameter is commented out.

2 Answers 2

9

Seems iptables was filtering everything out. Solution was to create a REDIS chain.

iptables -N REDIS
iptables -A REDIS -s 192.168.10.1 -j ACCEPT
iptables -A REDIS -s 192.168.10.2 -j ACCEPT
iptables -A REDIS -j LOG --log-prefix "unauth-redis-access"
iptables -A REDIS -j REJECT --reject-with icmp-port-unreachable
iptables -I INPUT -p tcp --dport 6379 -j REDIS

Hat tip to http://www.golja.org/blog/monitoring-traffic-with-iptables/

3
  • Thanks, @buggedcom. I had to add 127.0.0.1 to the REDIS chain so that I could access redis from its host: iptables -A REDIS -s 127.0.0.1 -j ACCEPT Commented Dec 21, 2015 at 6:50
  • are the LOG and REJET lines required? or optional?
    – IanVaughan
    Commented Dec 15, 2016 at 11:25
  • The linked article is down. This answer would be more useful if it included why each line was used, although I think in general the answer "fix your firewall rules with iptables" is a good one. Commented Apr 15, 2019 at 17:58
1

For me, I just use the Firewall GUI tool, to open the port 6379 TCP (which is being used by redis-server).

After that, I can use the redis-cli command line to connect using:

redis-cli -h <server IP> -p 6379

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .