0

I encountered the following problem(s) using Tomcat 7 with iptables on.

1) Namely, there's this Tomcat 7 instance that I run on server-1 (directly exposed), and this Tomcat instance hosts a REST web-service. Tomcat itself is configured with SSL (NIO, not APR/native), with clientAuth="true". Keystores, certs, and everything seems to be set up OK and working.

On this server, iptables are up and running allowing all traffic from server-2, and the last rule in the filter INPUT chain is:

-A INPUT -j REJECT --reject-with icmp-host-prohibited

Now, from server-2, I try to call the web-service and I fail with connection / read timeout exceptions.

2) Tomcat won't shut down - I get "No route to host" exception message when trying to shut it down via its shutdown script.

As soon as the last rule specified above in iptables on server-1 is removed, both problems go away... Both servers are running CentOS 6 64.

Can someone shed some light on this?

EDIT
Here are all the other current INPUT rules:

// VPN Related
-A INPUT -s xx.xx.xx.xx -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 1723 -j ACCEPT
-A INPUT -i eth0 -p gre -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 1701 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 443 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 1701 -j ACCEPT
// FreeRadius
-A INPUT -i eth0 -p tcp -m tcp --dport 1812 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 1813 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 1812 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 1813 -j ACCEPT
// Tomcat
-A INPUT -i eth0 -p tcp -m tcp --dport 4445 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 8345 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 8007 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 4445 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 8345 -j ACCEPT
// Allow all from server-2
-A INPUT -i eth0 -s xx.xx.xx.xx -j ACCEPT
// System
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
// Reject
-A INPUT -j REJECT --reject-with icmp-host-prohibited

3
  • We are going to need to see the other rules as clearly something is blocked that shouldn't be. At a guess, localhost is blocked on server-1 as that would prevent the shutdown script from working. Nov 21, 2013 at 9:56
  • Thanks Mark... yeah, seems you guessed right for blocked localhost. I updated the question with other rules.
    – Less
    Nov 21, 2013 at 12:47
  • What about output rules? Is server-1 allowed to send data to server-2? Nov 22, 2013 at 18:19

0

You must log in to answer this question.

Browse other questions tagged .