Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a CentOS installation as a guest VM with VirtualBox. I have two ethernet interfaces, eth0 with NAT and DHCP, and eth1 with Host-only adaptor and static IP.

I have oracle installed in this CentOS and I want to open the port of the database 1521 and the port of the oracle manager (which depends on the db...in this example 5500). So my

    # Firewall configuration written by system-config-firewall
    # Manual customization of this file is not recommended.
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 1521 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 1158 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 5500 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 465 -j ACCEPT
    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited
    COMMIT

And sudo iptables -nvL in the guest VM shows:

            Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination
     266K  103M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
        1    84 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
     4749  285K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
        3   192 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:1521
        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:1158
     1001  143K REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

    Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination
        0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

    Chain OUTPUT (policy ACCEPT 220K packets, 92M bytes)
     pkts bytes target     prot opt in     out     source               destination

It looks like there iptables shows less entries than the ones I have defined in the file.

sudo netstat -apnt | grep 5500 shows that the process is indeed running in 5500:

    tcp        0      0 192.168.56.11:25500         192.168.56.11:1521          ESTABLISHED 3332/emagent
    tcp        0      0 :::5500                     :::*                        LISTEN      3323/java
    tcp        0      0 ::ffff:192.168.56.11:1521   ::ffff:192.168.56.11:25500  ESTABLISHED 3891/oraclesampleDM

I did several telnet oracleserver XXX. It could connect with 22 and 1521. Which seem to be the first 2 that I added in the iptables. It refused to connect in all the rest...it seems it is using an old version of the file...

But from my host machine, if I open a browser and type https://oracleserver:5500/em/ I get a an error...

I have already done sudo iptables restart after having modified the file, and even reboot the OS.

I have commented the reject lines (to see if there could be a routing problem), and even service iptables stop. I still have the same problem. What is funny is that ssh works from host to guest..... route -n in the guest VM outputs:

    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    10.0.2.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
    192.168.56.0    0.0.0.0         255.255.255.0   U     0      0        0 eth1
    169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0
    169.254.0.0     0.0.0.0         255.255.0.0     U     1003   0        0 eth1
    0.0.0.0         10.0.2.2        0.0.0.0         UG    0      0        0 eth0

Anything weird?

share|improve this question
    
I would first verify that it actually is a firewall issue (and not potentially a routing issue) by temporarily deleting the one reject rule from the active iptables config, and testing again. Also, it may be helpful to include -n in your iptables command so the output in your post is a little clearer to people who don't know, for example, what "dbcontrol-oms" is. –  Joel Davis Apr 10 '13 at 20:38
    
Is that listing from the vm or from the host running the vm? –  ott-- Apr 10 '13 at 21:29
1  
Your iptables -L output is definitely missing some of the entries that you show in your config file. Can you redo the iptables -L as iptables -nvL instead? Also if your config file is correct, you should not do an iptables save as this will overwrite the config file with what is currently running. –  Patrick Apr 10 '13 at 21:55
    
@JoelDavis how can I easily check if there is a routing issue? because if I comment the reject...I still have the same problem as you suggested....I have updated the question with the iptables -nvL. –  Mariano Martinez Peck Apr 11 '13 at 12:36
    
@ott the listing is from the guest VM. –  Mariano Martinez Peck Apr 11 '13 at 12:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.