5

I created an Ubuntu instance on Oracle Cloud Infrastructure (OCI). I am able to connect to this instance with SSH (TCP 22). I created some services on this instance, like daytime (TCP 13), mail (TCP 25), http (TCP 80), dns (TCP/UDP 53). I added similar rules to the Default Security List on the OCI management web page of this instance similar to the default SSH rule. However, when I try to connect to any of these services from Internet I get No route to host error. The only exception is the SSH service which works with no problem.

Once I had installed ufw to this instance; however, later I disabled and removed ufw. After that, I removed iptables package also. So, now there is no Linux firewall at all. However, I still have this problem.

This seems to be an OCI-related problem. I had done similar configurations in other cloud platforms (AWS, GCP, etc.) with no problem.

Where else can I look to isolate this problem?


Update: Removing iptables and rebooting solved the problem. Now I will try to re-install iptables.

5

I found this issue with Oracle Linux in Oracle cloud. It has predefined set of blocking rules. So I was succesfully connecting 22 port (ssh), but was getting "No route to host" trying to connect other ports.
You need to open ports individually:

Ex, for Docker:

firewall-cmd  --permanent --zone=public --add-port=2377/tcp
firewall-cmd  --reload

Also, you need to setup security list for virtual cloud network.

3

The problem seems to be related to OCI not wanting you to use ufw in Ubuntu: https://docs.cloud.oracle.com/iaas/Content/knownissues.htm#ufw

I have to disable or remove ufw and edit the file /etc/iptables/rules.v4 as described in the link given above. After that, to enable the new rules, I need to run:

# iptables-restore </etc/iptables/rules.v4

It seems that the ufw rules do not have any effect in such a configuration and I have to use iptables. This is, however, not a very user-friendly way to manage the firewall rules on an Ubuntu server on OCI platform.

1

It can be in the network or in the Linux instance. And if it is in Linux, it can be the iptables or the service.

To start wit the last one, and because you have mail, try on the Linux box:

telnet 127.0.0.1 smtp
helo there
quit

Do you see 220, 250 and 221 messages? Then your mail service works. If you get Connection refused, then your service is not up and running.

Next, iptables -nvL should tell you if the ports are open for the outside world. If you cab't make heads -or tails of the output,

service iptables stop

should stop iptables, which for a test might be acceptable. You said that you got rid of ufw, so I assume sudo ufw disable won't be needed anymore.

If, with iptables out of the way, you are still not able to connect, it is probably a setting in the Amazon cloud, with which I have no experience.

2
  • There is no problem with connecting to the services locally (telnet 127.0.0.1 port_number works as expected). I cannot access them from Internet. service iptables stop will not work (at least in Ubuntu 18.04 it gives Failed to stop iptables.service: Unit iptables.service not loaded.); it is not a service. Sep 27 '19 at 17:25
  • You might try a reboot, which sometimes helps. If you can get another machine on the same network segment, you could try to telnet from there. But otherwise, it's an AWS problem. Sep 27 '19 at 17:40
0
nano /etc/iptables/rules.v4

Add below lines

-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

iptables-restore < /etc/iptables/rules.v4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.