Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a CentOS installation as a guest VM with VirtualBox. I have two ethernet interfaces, eth0 with NAT and DHCP, and eth1 with Host-only adaptor and static IP.

I have oracle installed in this CentOS and I want to open the port of the database 1521 and the port of the oracle manager (which depends on the db...in this example 5500). So my

    # Firewall configuration written by system-config-firewall
    # Manual customization of this file is not recommended.
    :INPUT ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 1521 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 1158 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 5500 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 465 -j ACCEPT
    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited

And sudo iptables -nvL in the guest VM shows:

            Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination
     266K  103M ACCEPT     all  --  *      *             state RELATED,ESTABLISHED
        1    84 ACCEPT     icmp --  *      *  
     4749  285K ACCEPT     all  --  lo     *  
        3   192 ACCEPT     tcp  --  *      *             state NEW tcp dpt:22
        0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:1521
        0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:1158
     1001  143K REJECT     all  --  *      *             reject-with icmp-host-prohibited

    Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination
        0     0 REJECT     all  --  *      *             reject-with icmp-host-prohibited

    Chain OUTPUT (policy ACCEPT 220K packets, 92M bytes)
     pkts bytes target     prot opt in     out     source               destination

It looks like there iptables shows less entries than the ones I have defined in the file.

sudo netstat -apnt | grep 5500 shows that the process is indeed running in 5500:

    tcp        0      0          ESTABLISHED 3332/emagent
    tcp        0      0 :::5500                     :::*                        LISTEN      3323/java
    tcp        0      0 ::ffff:   ::ffff:  ESTABLISHED 3891/oraclesampleDM

I did several telnet oracleserver XXX. It could connect with 22 and 1521. Which seem to be the first 2 that I added in the iptables. It refused to connect in all the rest...it seems it is using an old version of the file...

But from my host machine, if I open a browser and type https://oracleserver:5500/em/ I get a an error...

I have already done sudo iptables restart after having modified the file, and even reboot the OS.

I have commented the reject lines (to see if there could be a routing problem), and even service iptables stop. I still have the same problem. What is funny is that ssh works from host to guest..... route -n in the guest VM outputs:

    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   U     0      0        0 eth0   U     0      0        0 eth1     U     1002   0        0 eth0     U     1003   0        0 eth1         UG    0      0        0 eth0

Anything weird?

share|improve this question
I would first verify that it actually is a firewall issue (and not potentially a routing issue) by temporarily deleting the one reject rule from the active iptables config, and testing again. Also, it may be helpful to include -n in your iptables command so the output in your post is a little clearer to people who don't know, for example, what "dbcontrol-oms" is. – Bratchley Apr 10 '13 at 20:38
Is that listing from the vm or from the host running the vm? – ott-- Apr 10 '13 at 21:29
Your iptables -L output is definitely missing some of the entries that you show in your config file. Can you redo the iptables -L as iptables -nvL instead? Also if your config file is correct, you should not do an iptables save as this will overwrite the config file with what is currently running. – Patrick Apr 10 '13 at 21:55
@JoelDavis how can I easily check if there is a routing issue? because if I comment the reject...I still have the same problem as you suggested....I have updated the question with the iptables -nvL. – Mariano Martinez Peck Apr 11 '13 at 12:36
@ott the listing is from the guest VM. – Mariano Martinez Peck Apr 11 '13 at 12:38

This comment by ott-- seems correct. If the screen dump above is complete, the service is only listening to 5500 on IPv6 and it's not listening to 1158 at all.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.