# Problems setting up web server in CentOS

I want to set up a web server on one of my computers (Dell Desktop) and decided on CentOS as the OS. Apache is installed properly (I think. pgrep httpd returns a bunch of processes that are running). I also think that my httpd.conf file is ok (I've read about 4 tutorials on apache setup). My ISP is comcast. I have httpd listening on both port 80 and 8080.

But it's not working and I can't figure out why. I had a friend try to see my test.html page (which is in /var/www/html/ - where it's supposed to be.) and he got http error 504, which seems to relate to a proxy or firewall, neither of which I have.

I have several questions: 1) is there a way to test my setup without having an outside friend try to see my web page? My own browser on the server sees the page fine when I use its local address (192.168.1.5) for the url, but the browser on another computer on my network (192.168.1.3) cannot see the page. 2) What, specifically, is needed to run a web server? Just a properly configured apache? Assuming I don't need php or any sql functionality. 3) is it possible that comcast is messing up the system somehow? 4) is it possible my own router is messing up the system somehow (can't see it if it is)?

I don't seem to be able to attach my httpd.conf file. I don't want to cut and paste it here because it's too long (even with the comments deleted).

Thanks for the help.

-
Do you "see" the access in httpd error and/or access log? –  Nils Jul 27 '12 at 21:33
Is your default-route directed towards the outside world? –  Nils Jul 27 '12 at 21:34

By default, CentOS has its firewall (iptables) setup to not allow incoming traffic on port 80.

Run this to allow incoming traffic on port 80:

iptables -A INPUT -p tcp --dport 80 -j ACCEPT


Then run this to save the configuration:

/sbin/service iptables save


These commands need to be run as root. No services should need to be restarted for the changes to take effect.

More information on iptables for CentOS can be found in their wiki at CentOS.org in the How To's section.

Regarding your friend not being able to connect:

Your router is most likely keeping him out. The Comcast Cable Modem could also be keeping him out.

Most routers, by default, are setup to use DHCP and routing. This means that your router has assigned your computer(s) an internal IP address according to its own IP range, subnet mask, and gateway. All traffic from your ISP assigned IP address is routed through the router to the IP addresses it has assigned to your computers via DHCP.

In order to allow traffic through the router from external sources on port 8080, you would need to setup port forwarding from an external source on the specified port to your router assigned IP address. This is done in the router configuration.

An alternative to this is to put your computer in a DMZ (demilitarized zone), which will allow all traffic, both incoming and outgoing, to be unfiltered to that computer. Note that this is a huge security risk, and is not suggested. However, should you choose to do so, this setting is also commonly found in the router configuration.

-
Thanks nojak. All that was very helpful, especially the iptables stuff. I hadn't heard or read that about CentOS, although, I can't imagine why, as I had gone though a few CentOS tutorials on setting up a web server. Gracias. –  bev Jul 29 '12 at 20:11
The problem was solved by learning about IPtables. The firewall settings was what was keeping the thing from working –  bev Oct 3 '12 at 5:35

1) The server may have been configured to allow connections only from the localhost. Check the configuration for allow directives. You likely want to restrict public access to your web content directory. This is likely /var/www or /srv/www. You may also be blocking incoming web access with iptables.

2) Simple html Apache is enough. I believe it is still the dominant web server on the Internet.

4) To allow your friend to connect from the Internet you will need to port forward port 8080 and/or port 80 to your webserver (192.168.1.3). It may cause problems locally if both address are connected using WiFi and isolation is enabled.

The following settings allow access to content under /var/www. It also enables a few options. You should have something similar in your configuration.

    <Directory /var/www/>
AllowOverride None
Order allow,deny
allow from all
</Directory>

-
Thanks. Actually, my httpd.conf file does not have the above. It has <Directory />, but no <Directory /var/www/>. I've included your suggestion. –  bev Jul 29 '12 at 19:49
@bev The <Directory /> could allow access but it is more secure for it to deny from all. The /var/www should match the directory specified as your site's DocumentRoot. –  BillThor Jul 31 '12 at 0:26

1) Use the web proxy like hidemyass.com

2) For simple html Apache is enough.

3) Unlikely

4) If the router is between 192.168.1.3 and 192.168.1.5 it can cause problems if incorrecly configured. If it is not than the problem is either apache config, iptables rules or possibly some IPS if you have one...

Use

netstat -cpatn


command on the server to see incomming connections while accessing the page from other computer.

you can use

tcpdump -X -s0 "dst port 80 and src port 80"


to analyze the trafic further.

-
Thanks mnmnc. Your suggestions are helpful. –  bev Jul 29 '12 at 20:15

If you think it is the iptable (firewall) do service iptables stop and try browsing if you can't get it from a machine that is in the same subnet.

For a friend to be able to get to your web page in a enviroment that is at home and with simple ISP such as Comcast, AT&T (dynamic ip) then:

1. you will have to find out you current public IP address.
2. ideally do dhcp reservation for you web server so it has same IP address.
3. set port forward on your router to forward port 80 traffic to your interal webserver.
-

This looks like a router issue. To make sure you can see the page on another computer on the same network, make sure you can forward the ports from the router page. In your case, it's most pronabl

-