Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a VirtualBox set up on a Windows 2008 R2 Standard Server (64bit). In the VirtualBox I run a CentOS 6.3. I have set up Bridged Networking with a static IP address. Things work fine, I can ping the client and the from the client to the outside. I can also SSH into the VM.

However, I cannot access any other services running in the client.

Here's some weird stuff, ping:

> ping -c 2 192.168.218.23
PING 192.168.218.23 (192.168.218.23) 56(84) bytes of data.
64 bytes from 192.168.218.23: icmp_req=1 ttl=62 time=45.7 ms
64 bytes from 192.168.218.23: icmp_req=2 ttl=62 time=41.6 ms

and nmap:

> nmap 192.168.218.23

Starting Nmap 5.21 ( http://nmap.org ) at 2012-09-07 15:28 CEST
Note: Host seems down. If it is really up, but blocking our ping probes, try -PN
Nmap done: 1 IP address (0 hosts up) scanned in 0.09 seconds

and nmap -PN:

> nmap 192.168.218.23 -PN
Starting Nmap 5.21 ( http://nmap.org ) at 2012-09-07 15:28 CEST
Nmap scan report for vub-backup-02v.zentrale.vpn.vub.de (192.168.218.23)
Host is up (0.53s latency).
Not shown: 999 filtered ports
PORT   STATE SERVICE
22/tcp open  ssh

Nmap done: 1 IP address (1 host up) scanned in 73.36 seconds

and another nmap version:

# nmap 192.168.218.23

Starting Nmap 5.51 ( http://nmap.org ) at 2012-09-07 15:32 CEST
Nmap scan report for 192.168.218.23
Host is up (0.0010s latency).
Not shown: 999 filtered ports
PORT   STATE SERVICE
22/tcp open  ssh

Nmap done: 1 IP address (1 host up) scanned in 4.93 seconds

But here is the netstat of the client VM:

# netstat -ltpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State           PID/Program name   
tcp        0      0 0.0.0.0:111                 0.0.0.0:*                   LISTEN      1081/rpcbind        
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1431/sshd           
tcp        0      0 0.0.0.0:8983                0.0.0.0:*                   LISTEN      3059/java           
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      1240/cupsd          
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1507/master         
tcp        0      0 0.0.0.0:35071               0.0.0.0:*                   LISTEN      1099/rpc.statd      
tcp        0      0 :::57196                    :::*                        LISTEN      1099/rpc.statd      
tcp        0      0 :::111                      :::*                        LISTEN      1081/rpcbind        
tcp        0      0 :::22                       :::*                        LISTEN      1431/sshd           
tcp        0      0 ::1:631                     :::*                        LISTEN      1240/cupsd          
tcp        0      0 ::1:25                      :::*                        LISTEN      1507/master         

So why can I not reach port 8983 or 111 from the outside?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Stefan, The most likely cause from my experience is that the iptables firewall is on with the default setting of REJECT ALL. You will need to turn off the firewall or open ports to allow the traffic through. The default firewall rules do permit SSH. Here are the iptable defaults for CentOS:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

I would suggest that you first disable the firewall using

/sbin/service iptables stop

then trying to access the services again. If it works, add the following rules to iptables:

/sbin/iptables -I INPUT 5 -p tcp -m state --state NEW -m tcp --dport 8983 -j ACCEPT
/sbin/iptables -I INPUT 5 -p tcp -m state --state NEW -m tcp --dport 111 -j ACCEPT

and restart the firewall using

/sbin/service iptables start

NOTE: If you are using port 111 for RPCs, (it is the standard port for the RPC portmapper) you need to take look at the following and make appropriate changes: Chapter 30: The sysconfig directory /etc/sysconfig/nfs

If it doesn't work, the Windows Firewall may be blocking the traffic.

share|improve this answer
    
Thanks heaps! I did run iptables -L but I totally missed that last "REJECT all". –  Stefan Seidel Sep 9 '12 at 22:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.