0

I was following the centos wiki page on iptables but no mater what I change only port 22 opens. Using various port scanning websites they all say the server is actively refusing connections on all other ports.

Here is the iptables -L

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:urd
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3s
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imaps
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

From what I understand INPUT (policy DROP) should drop all traffic that does not have a defined rule, and I set the rules to accept port 443/25/465 exc. but they all show up blocked. Yet port 22 (ssh) is unblocked and works fine.

Does anyone understand what i'm doing wrong?

  • What commands are you actually inputting? – El Chapo Gluzman May 28 '15 at 19:07
  • sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT – MSQLnoob020983 May 28 '15 at 19:09
  • 2
    Please post the output for netstat -anp – krisFR May 28 '15 at 23:13
  • posted it. I still have no idea why it blocks everything but ssh. – MSQLnoob020983 May 29 '15 at 17:22
0

Its been awhile since I've done iptables but I think you want to have a rule that always allows established connections:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

See this post: What is "state RELATED,ESTABLISHED" in iptables?

| improve this answer | |
  • Still blocking everything, thanks though. – MSQLnoob020983 May 28 '15 at 19:11
  • you might need to specify it for each port as in iptables -A INPUT -p tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT – Cfreak May 28 '15 at 19:13
  • did iptables -F, redid all the rules that way, no effect. – MSQLnoob020983 May 28 '15 at 19:20
0

sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

All that command does is add a rule allowing SSH connections over tcp port 22.

You need to:

-Load the state module

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-Set the default policy on a chain

iptables -P INPUT DROP

-Set default policy to drop

iptables -P FORWARD DROP

-Then you start establshing rules ala:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

or

iptables -A INPUT -p tcp -s 192.168.0.0/24 --dport 22 -j ACCEPT

or allow all incoming SSH, HTTP and HTTPS traffic in one line

iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,443 -m state --state ESTABLISHED -j ACCEPT

| improve this answer | |
  • Tried, did not work. Thanks though. Still blocking everything but port 22. – MSQLnoob020983 May 28 '15 at 19:29
  • Did you change the rules according to ports like iptables -A INPUT -p tcp --dport 80 -j ACCEPT – El Chapo Gluzman May 28 '15 at 19:38
  • Yep. Am I wrong in thinking that iptables -F opens all ports if all policy's are set to accept? Because right now I have 0 rules, everything on accept and it's still blocking everything but port 22. Maybe Iptables is not the problem. – MSQLnoob020983 May 28 '15 at 19:47
  • Your being locked out by the default filter policies not being removed when you run the iptables -F command; you're setting the policy to default deny/accept and then flushing all the rules that let you in. -F flushes all the rules...that's your problem. You are deleting all existing rules everytime you run -F – El Chapo Gluzman May 28 '15 at 19:54
  • That's exactly what im trying to do. If I have all ports open, no firewall blocking anything and i'm still being blocked then something is wrong with my system. – MSQLnoob020983 May 28 '15 at 20:05
0

Two thoughts:

1) Do you have services running on those other ports? (netstat -an) 2) Is the server hosted somewhere, like a home ISP, that doesn't allow incoming connections on those other ports?

| improve this answer | |
  • 1. I'm not entirely sure what i'm looking at with netstat. It dumped a lot of stuff to console. 2. It's a digital ocean virtual server. I have quite a few running, all same OS and iv never had this problem before. – MSQLnoob020983 May 28 '15 at 20:10
  • Try to run netstat -an | grep 80 to see if http is listening. Substitute 443 and 25 for https and smtp, respectively. Post results back here. – SteveS May 29 '15 at 21:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.