Subject: iptables -- Linux firewall settings
Author: Linux
Posted on: 02/17/2016 02:57:51 AM
Chances are that you set up a server running on specific port, e.g. 8433, it can be accessed from inside:
# nc -zv 127.0.0.1 8443
Connection to 127.0.0.1 8443 port [tcp/cncp] succeeded!
# nc -zv 10.11.12.13 8443
nc: connect to 10.11.12.13 port 8443 (tcp) failed: No route to host
or
# telnet 10.11.12.13 8443
Trying 10.11.12.13...
telnet: Unable to connect to remote host: No route to host
The root cause is that the firewall on your Linux box forbid it from being accessed from outside. You can try the following:
# /sbin/iptables -I INPUT -p tcp -m tcp --dport 8443 -j ACCEPT
# /sbin/service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
You can verify it by viewing file
/etc/sysconfig/iptables
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [279880:89989886]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -p tcp -m tcp --dport 8443 -j ACCEPT
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m state --state NEW -m udp --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 139 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 445 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 23 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
And checking the connection:
# nc -zv 10.11.12.13 8443
Connection to 10.11.12.13 8443 port [tcp/cncp] succeeded!
or
# telnet 10.11.12.13 8443
Trying 10.11.12.13...
Connected to 10.11.12.13.
Escape character is '^]'.
References:
