11

I created an Ubuntu instance on Oracle Cloud Infrastructure (OCI). I am able to connect to this instance with SSH (TCP 22). I created some services on this instance, like daytime (TCP 13), mail (TCP 25), http (TCP 80), dns (TCP/UDP 53). I added similar rules to the Default Security List on the OCI management web page of this instance similar to the default SSH rule. However, when I try to connect to any of these services from Internet I get No route to host error. The only exception is the SSH service which works with no problem.

Once I had installed ufw to this instance; however, later I disabled and removed ufw. After that, I removed iptables package also. So, now there is no Linux firewall at all. However, I still have this problem.

This seems to be an OCI-related problem. I had done similar configurations in other cloud platforms (AWS, GCP, etc.) with no problem.

Where else can I look to isolate this problem?


Update: Removing iptables and rebooting solved the problem. Now I will try to re-install iptables.

5 Answers 5

10

The problem seems to be related to OCI not wanting you to use ufw in Ubuntu: https://docs.cloud.oracle.com/iaas/Content/knownissues.htm#ufw

I have to disable or remove ufw and edit the file /etc/iptables/rules.v4 as described in the link given above. After that, to enable the new rules, I need to run:

# iptables-restore </etc/iptables/rules.v4

It seems that the ufw rules do not have any effect in such a configuration and I have to use iptables. This is, however, not a very user-friendly way to manage the firewall rules on an Ubuntu server on OCI platform.

6

I found this issue with Oracle Linux in Oracle cloud. It has predefined set of blocking rules. So I was succesfully connecting 22 port (ssh), but was getting "No route to host" trying to connect other ports.
You need to open ports individually:

Ex, for Docker:

firewall-cmd  --permanent --zone=public --add-port=2377/tcp
firewall-cmd  --reload

Also, you need to setup security list for virtual cloud network.

4

These are the exact steps that worked for me, based on FedKad's answer to his original post...

The following extra steps were needed on the Oracle cloud, to open up ports on Ubuntu 20:

  1. sudo vim /etc/iptables/rules.v4 (or whatever editor you use)

  2. After the line -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT , insert:

-A INPUT -p tcp -m state --state NEW -m tcp --dport 1234 -j ACCEPT

(change the number of the port that needs to be opened!)

  1. At the shell prompt:

sudo su -

iptables-restore < /etc/iptables/rules.v4

exit

  1. The newly-opened port may be tested by going on another Linux machine, and issuing the command:

nc -zvw100 THE_IP_ADDRESS_OF_MACHINE_WHOSE_PORT_WE_OPENED THE_PORT_NUMBER

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Mar 10, 2022 at 5:28
2
nano /etc/iptables/rules.v4

Add below lines

-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

iptables-restore < /etc/iptables/rules.v4
1

It can be in the network or in the Linux instance. And if it is in Linux, it can be the iptables or the service.

To start wit the last one, and because you have mail, try on the Linux box:

telnet 127.0.0.1 smtp
helo there
quit

Do you see 220, 250 and 221 messages? Then your mail service works. If you get Connection refused, then your service is not up and running.

Next, iptables -nvL should tell you if the ports are open for the outside world. If you cab't make heads -or tails of the output,

service iptables stop

should stop iptables, which for a test might be acceptable. You said that you got rid of ufw, so I assume sudo ufw disable won't be needed anymore.

If, with iptables out of the way, you are still not able to connect, it is probably a setting in the Amazon cloud, with which I have no experience.

2
  • There is no problem with connecting to the services locally (telnet 127.0.0.1 port_number works as expected). I cannot access them from Internet. service iptables stop will not work (at least in Ubuntu 18.04 it gives Failed to stop iptables.service: Unit iptables.service not loaded.); it is not a service.
    – FedKad
    Sep 27, 2019 at 17:25
  • You might try a reboot, which sometimes helps. If you can get another machine on the same network segment, you could try to telnet from there. But otherwise, it's an AWS problem. Sep 27, 2019 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.