Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is what I have: iptables -i em1 -A INPUT -j ACCEPT -p tcp --dport 9001 -v. If I want to accept incoming connections on port 9001 at this (, or on the network address, what am I doing wrong?

share|improve this question

I think your command is fine. Although the argument order is somewhat unorthodox it should work.

The problem is most likely that iptables rules take affect in the order which they are entered. If you enter a block rule that matches, then a allow rule, the allow rule won't get used because the packet already matched a block rule.

The general practice when setting up iptables is to flush all the rules, set the policy, then enter all the things you want to allow, then deny everything else using a broad matching rule. I suspect you have the order wrong and are denying everything due to a previously set rule and now trying to add an allow.

share|improve this answer
so iptables -F INPUT; iptables -i em1 -A INPUT -j ACCEPT -p tcp --dport 9001 -v; iptables -A INPUT j DORP ? – 12312312123 Jul 30 '11 at 19:45
I think it just worked :), however I'd still like to know if I'm leaving my box wide open or not :P – 12312312123 Jul 30 '11 at 19:47
@12312312123: Other than the typo which should have given you an error (-j DROP not j DORP) that combination should do the trick. Try it by listening on another port with nc or something simple to open a test port and then try to talk to it. – Caleb Jul 30 '11 at 20:02

If those are your only rules you should be extremely closed. You may want to restrict the IP addresses you accept data from. It is common to start chains with a rule to accept RELATED and ESTABLISHED connections.

If you aren't sure what you are doing you may want to use a tool to build your firewall. I use Shorewall which is well documented. It will generate logging rules for you so you can see the traffic being blocked. (Commonly probed ports such as windows shares are not logged in the default configuration.) There are example sets for 1, 2, and 3 interface configurations included in the documentation. There are also commands that allow you to view your firewall configuration and connections easily.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.