2

I'm trying to get Jenkins running on a RHEL 6 server. Jenkins is installed but not accessible due to firewall rules. If I stop iptables with service iptables stop, I can access Jenkins in my browser on port 8080. With the service restarted, I can't access it.

I have tried various ways of adding a rule to iptables to allow traffic on port 8080, to no avail.

Here is the current output of iptables -L -n with the Jenkins/port 8080 rule at the first line of the INPUT section:

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8080
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:25
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:25
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:53
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:53
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:53
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:5353
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:5353
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:5353
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:5353
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:443
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:123
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:161
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:161
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:389
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:389
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:636
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:636
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8140
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:8140
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:111
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:111
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:111
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:111
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:2049
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2049
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:2049
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:2049
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:4046
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:4046
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:4046
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:4046
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:4045
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:4045
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:4047
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:4047
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:4049
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:514
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:514
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:717
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:717
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:6000
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:6000
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2435
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:2435
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:4526
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:4526
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2659
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:2659
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:1521
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:1521

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:25
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:25
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:53
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:53
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:53
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:5353
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:5353
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:5353
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:5353
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:123
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:161
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:161
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:389
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:389
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:636
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:636
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:8140
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8140
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:111
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:111
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:111
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:111
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:2049
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:2049
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:2049
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2049
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:4046
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:4046
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:4046
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:4046
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:4045
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:4045
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:4047
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:4047
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp spt:4049
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:514
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:514
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:6000
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:6000
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:717
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:717
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:2435
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2435
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:4526
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:4526
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:2659
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:2659
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:1521
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:1521

2 Answers 2

2

Gazareth, if you notice besides iptables INPUT queue rules, you have configured OUTPUT queue rules, and the 8080/TCP port is not allowed/configured in the OUTPUT queue.

As you have added:

iptables -I INPUT -p tcp --dport 8080 -j ACCEPT

You also need to add:

iptables -I OUTPUT -p tcp --sport 8080 -j ACCEPT

iptables is capable of maintaining stateful firewall rules, and as such, instead of maintaining two different queues, it is also possible to do:

iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Be aware that while doing it by hand, you use -I to place rules at the top of the queue, and when doing it in a batch file, typically you do iptables -A.

Saving Iptables Firewall Rules Permanently

25 Most Frequently Used Linux IPTables Rules Examples

0
0

The default Jenkins installation runs on ports 8080 and 8443. Typically, HTTP/HTTPS servers run on ports 80 and 443, respectively. But these ports are considered privileged on Unix/Linux systems, and the process using them must be owned by root. Running Jenkins as root is not recommended - it should be run as its own user.

So you need to forward the traffic from port 80/443 to 8080/8443. You must ensure that iptables has allowed traffic on all 4 of these ports.

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8443

iptables-save > /etc/sysconfig/iptables

Alternatively,

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 127.0.0.1:8080

1
  • 1
    I am not trying to forward to port 80. I am trying to access on port 8080.
    – gazareth
    Feb 16, 2016 at 11:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .