Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a VmWare with an application under JBoss starting up on port 8080. I'm able to access the app from outside the VM if the iptables are off.

However, I must turn on iptables due to some rules, but I couldn't open port 8080. I tried: -A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT and -A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT but no success.

Output of netstat -tulpn with iptables rule:

Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0* LISTEN 6617/java

What am I missing here?


share|improve this question

You have probably APPENDED the rule to the table after a policy that denies access. You should try INSERTING the rule. The difference is replacing -A INPUT with -I INPUT, so the command would be

-I INPUT -p tcp -m tcp --dport 8080 -j ACCEPT 

Another possibility (not sure where you have specified the rule) is that you need to modify the FORWARD chain rather then the input chain - if this rule exists on the VM host rather then the VM.

share|improve this answer
It's not working yet, when I execute service iptables save it's going to /etc/sysconfig/iptables. This is what I got now: [root@devsrvr ~]# more /etc/sysconfig/iptables *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [23:1780] :OUTPUT ACCEPT [23:1780] -A PREROUTING -d -p tcp -j DNAT --to-destination COMMIT *filter :INPUT ACCEPT [151:22125] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [275:33909] -A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT COMMIT – Adami Sep 2 '13 at 12:43
I've just found out that the rule iptables -t nat -A PREROUTING --dst -p tcp -j DNAT --to-destination is doing that. Any idea of how can I have that rule and also access through port 8080? – Adami Sep 2 '13 at 13:18
As your default policies all appear to be "ACCEPT", I can't see any reason why this is not working. I'm guessing you have dropped the rest of the firewall and it works now ? If so, what does it look like with the Firewal on ? If the firewall is meant to be like this, what does the firewall on the VM show ? – davidgo Sep 2 '13 at 20:21
You write "You have probably APPENDED the rule to the table after a policy that denies access. You should try INSERTING the rule" <---From the little I know of iptables, if a policy denies access, then appending a rule should work.It doesn't matter if the accept rule is first or last..The only time appending a rule might not work is if there is a deny rule before it.But I don't think there should be.. AFAIK(not much) i'd guess the only normal/useful configurations are blacklists and whitelists so with a policy of deny, the rules should be only accept. And appending or inserting won't matter – barlop May 27 '15 at 16:12
There may be a rule missing allowing established connections through, so maybe also "iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT" may be needed to match the returning traffic. @barlop - Rule order is important when using IPTABLES, if traffic matches a drop rule before its matched, it will be dropped at that point. Rules are processed in order they are added, with -I adding them at the beginning and -A adding them at the end. – davidgo Mar 7 at 7:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.