1

I am trying to reconfigure httpd my virtual private server but I cannot seem to access it. curl on the server itself works but trying to hit the server using chrome on another pc gives a "this site took too long to respond" error message.

My vps has centos 7 but oddly it has iptables and not firewalld installed.

this is the contents of my /etc/sysconfig/iptables file, do I need to change something to allow http on port 80 and https on 443?

# Generated by iptables-save v1.4.21 on Wed Mar 27 19:30:55 2019
*raw
:PREROUTING ACCEPT [654:52805]
:OUTPUT ACCEPT [577:72088]
COMMIT
# Completed on Wed Mar 27 19:30:55 2019
# Generated by iptables-save v1.4.21 on Wed Mar 27 19:30:55 2019
*mangle
:PREROUTING ACCEPT [654:52805]
:INPUT ACCEPT [654:52805]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [577:72088]
:POSTROUTING ACCEPT [577:72088]
COMMIT
# Completed on Wed Mar 27 19:30:55 2019
# Generated by iptables-save v1.4.21 on Wed Mar 27 19:30:55 2019
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [44:9111]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Mar 27 19:30:55 2019
# Generated by iptables-save v1.4.21 on Wed Mar 27 19:30:55 2019
*nat
:PREROUTING ACCEPT [392:22692]
:POSTROUTING ACCEPT [14:1008]
:OUTPUT ACCEPT [14:1008]
COMMIT
# Completed on Wed Mar 27 19:30:55 2019
  • I would dump it and switch to firewalld. yum swap iptables-services firewalld Then yell at whoever configured that VPS. – Michael Hampton Apr 1 at 4:07
4

Looks like your "allow" rule is after the "reject" rule. This part:

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

You need to move that allow rule one line up.

To troubleshoot, you can do the following:

sudo watch -n1 -d iptables -t filter -L INPUT -nvx --line-numbers

You'll see something like this:

Every 1.0s: iptables -t filter -L INPUT -nvx                                                         localhost: Mon Apr  1 14:08:04 2019

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source               destination
1          12      956 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
2           0        0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
3           3      281 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
4           1       90 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited
5           0        0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443 ctstate NEW,ESTABLISHED

Now watch the number of packets going through each rule, and see which one grows when you run your test. This may be your hint.

To fix this, you can do an online rule change. E.g., add that last rule as rule number 4, and then remove the last rule.

With the above output, you want to insert the "allow rule" as rule number 4.

$ sudo iptables -I INPUT 4 -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Now check the rules again

$ sudo iptables -L INPUT -n --line-numbers

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443 ctstate NEW,ESTABLISHED
5    REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited
6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443 ctstate NEW,ESTABLISHED

And now delete the last rule, which is obsolete.

$ sudo iptables -D INPUT 6

Double check your output again.

$ sudo iptables -t filter -L INPUT --line-numbers

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443 ctstate NEW,ESTABLISHED
5    REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

In all fairness, I don't see rules defaulting to "REJECT" often. A more common one is "DROP", and you can set that as a default policy. E..g,

$ sudo iptables -t filter -P INPUT DROP

Then you can remove the "reject" rule altogether

$ sudo iptables -t filter -D INPUT -j REJECT --reject-with icmp-host-prohibited
$ sudo iptables -L INPUT -n
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443 ctstate NEW,ESTABLISHED

Now sure what your OS is, but you can probably sudo service iptables save to save your runtime changes to /etc/sysconfig/iptables.

  • Awesome work, thank you for the through explanation. I really appreciate that you took the time to explain why you ran each command and what it did. I will forever have a better understanding of iptables thanks to you! – Kynrek Apr 1 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.