use iptables to allow incoming connections to some computer on port XYZ?

Question

This is what I have: iptables -i em1 -A INPUT -j ACCEPT -p tcp --dport 9001 -v. If I want to accept incoming connections on port 9001 at this (127.0.0.1, or on the network 192.168.1.143) address, what am I doing wrong?

Answer 1

I think your command is fine. Although the argument order is somewhat unorthodox it should work.

The problem is most likely that iptables rules take affect in the order which they are entered. If you enter a block rule that matches, then a allow rule, the allow rule won't get used because the packet already matched a block rule.

The general practice when setting up iptables is to flush all the rules, set the policy, then enter all the things you want to allow, then deny everything else using a broad matching rule. I suspect you have the order wrong and are denying everything due to a previously set rule and now trying to add an allow.

Answer 2

If those are your only rules you should be extremely closed. You may want to restrict the IP addresses you accept data from. It is common to start chains with a rule to accept RELATED and ESTABLISHED connections.

If you aren't sure what you are doing you may want to use a tool to build your firewall. I use Shorewall which is well documented. It will generate logging rules for you so you can see the traffic being blocked. (Commonly probed ports such as windows shares are not logged in the default configuration.) There are example sets for 1, 2, and 3 interface configurations included in the documentation. There are also commands that allow you to view your firewall configuration and connections easily.