Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I recently installed Oracle Linux 6 on a home server, and I've been having trouble with allowing ports past the firewall (iptables). I've tried adding ports with the command

iptables -I INPUT -p tcp --dport 80 -s 192.168.0.0/24 -j ACCEPT

My current rules configuration is:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  192.168.0.0/24       anywhere            tcp dpt:ldap 
ACCEPT     tcp  --  192.168.0.0/24       anywhere            tcp dpt:x11 
ACCEPT     tcp  --  192.168.0.0/24       anywhere            tcp dpt:vnc-server 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with     icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Yet I cannot access these ports (except for ssh, which was apparently auto-configured) from any devices on my network (all of which start with 192.168.0.*). If I flush the tables (iptables -F), all connections are functional. I have saved and reloaded the table. Any ideas as to why this is not working?

share|improve this question

migrated from security.stackexchange.com May 12 at 22:52

This question came from our site for Information security professionals.

1 Answer 1

up vote 3 down vote accepted

iptables processes packets according to every rule in order. You're appending the rule to accept HTTP traffic after the rule that rejects all traffic:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

...

ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http

If a packet hasn't matched any of the earier rules, it ends up here. If it's a new TCP connection to SSH, it matches the first rule. If it's not (for instance, if it's an HTTP packet), it proceeds to the next rule which rejects any traffic that hasn't been matched up until this point. Because of this, the last rule will never be matched, because any new HTTP traffic will have already been rejected by the previous rule.

I'm not sure how Oracle Linux recommends you configure your firewall rules (Ubuntu, for example, encourages the use of ufw). One simple thing is to insert the HTTP rule before the REJECT (iptables -I INPUT $INDEX, where $INDEX is the index of the REJECT rule). Another, which is more in the "spirit" of iptables is to remove the explicit REJECT rule and change the default policy to REJECT. This causes packet rejection to be done implicitly for any packed which hasn't been matched with a rule, so you can simply append ACCEPTs to the end and not worry about placing them before the explicit REJECT.

share|improve this answer
    
How do I change it to implicit? –  Fearless May 12 at 19:28
    
Oh, and OL6 is very similar to RHEL if that helps. –  Fearless May 12 at 19:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.