Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I recently upgraded a system from Fedora 17 to 19. Now, I am not able to connect to any service other than ssh (perhaps a few others may be available but not sure) on it. Earlier this was not a problem. I have tried to disable any firewall:

$ sudo service iptables stop
Redirecting to /bin/systemctl stop  iptables.service
$ sudo /etc/init.d/ebtables stop
Stopping ebtables (via systemctl):                         [  OK  ]

Also tried nc at arbitrary port:

$ nc -l 28000

and tried to connect from another host:

$ nc myhost 28000
Ncat: No route to host.

Any ideas? I am using KVM on this host to support Linux guests with bridged networking (note I am trying to troubleshoot the physical host not the guests), if that helps. Also, here is the output of chkconfig.

Note: This output shows SysV services only and does not include native
      systemd services. SysV configuration data might be overridden by native
      systemd configuration.

      If you want to list systemd services use 'systemctl list-unit-files'.
      To see services enabled on particular target use
      'systemctl list-dependencies [target]'.

btseed          0:off   1:off   2:off   3:off   4:off   5:off   6:off
bttrack         0:off   1:off   2:off   3:off   4:off   5:off   6:off
ceph            0:off   1:off   2:off   3:off   4:off   5:off   6:off
dkms_autoinstaller      0:off   1:off   2:on    3:on    4:on    5:on    6:off
ebtables        0:off   1:off   2:off   3:off   4:off   5:off   6:off
jexec           0:on    1:on    2:on    3:on    4:on    5:on    6:on
livesys         0:off   1:off   2:off   3:on    4:on    5:on    6:off
livesys-late    0:off   1:off   2:off   3:on    4:on    5:on    6:off
netconsole      0:off   1:off   2:off   3:off   4:off   5:off   6:off
network         0:off   1:off   2:on    3:on    4:on    5:on    6:off
vboxballoonctrl-service 0:off   1:off   2:off   3:off   4:off   5:off   6:off
vboxdrv         0:off   1:off   2:off   3:off   4:off   5:off   6:off
vboxweb-service 0:off   1:off   2:off   3:off   4:off   5:off   6:off
share|improve this question
    
@slm, yes, the KVM guest has bridged networking. I am concerned about the physical host though. –  r.v Aug 10 '13 at 16:37
    
Everything is on the host. I am not talking about the guest. –  r.v Aug 10 '13 at 16:40
    
Perhaps, I should make it clearer in the question. –  r.v Aug 10 '13 at 16:41
    
already did it. –  r.v Aug 10 '13 at 16:46
    
See my update below. –  slm Aug 10 '13 at 16:47

2 Answers 2

TL;DR;

The issue was with firewalld, disabling it resolved the OP's problem. Below is a list of things to try when you encounter a problem like this (for others).

1. Networking?

Is the KVM guest using bridged networking?

It's likely that your KVM guest has a NIC that isn't associated to the host's bridged device, so services won't be accessible from the network that are running on the guest.

2. SELinux?

You can temporarily disable it to see if it's causing you issues.

$ sudo setenforce 0

$ getenforce 
Disabled

3. Firewall (static rules)?

Temporarily disable it.

$ sudo service iptables stop

$ sudo iptables -L

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

4. Firewall (dynamic rules)?

In newer versions of Fedora a new service is now included called firewalld. You can try disabling it.

$ sudo service firewalld stop

excerpt from wiki

firewalld provides a dynamically managed firewall with support for network/firewall zones to define the trust level of network connections or interfaces. It has support for IPv4, IPv6 firewall settings and for ethernet bridges and has a separation of runtime and permanent configuration options. It also supports an interface for services or applications to add firewall rules directly.

The former firewall model with system-config-firewall/lokkit was static and every change required a complete firewall restart. This included also to unload the firewall netfilter kernel modules and to load the modules that are needed for the new configuration. The unload of the modules was breaking stateful firewalling and established connections.

The firewall daemon on the other hand manages the firewall dynamically and applies changes without restarting the whole firewall. Therefore there is no need to reload all firewall kernel modules. But using a firewall daemon requires that all firewall modifications are done with that daemon to make sure that the state in the daemon and the firewall in kernel are in sync. The firewall daemon can not parse firewall rules added by the ip*tables and ebtables command line tools.

The daemon provides information about the current active firewall settings via D-BUS and also accepts changes via D-BUS using PolicyKit authentication methods.

share|improve this answer
    
I am talking about the host here not the guest. Although I stated this info about running KVM with bridged networking as that may have some issues, it is unlikely that the issue is at this low level because ssh is working fine. –  r.v Aug 10 '13 at 16:40
    
I had already disabled iptables as indicated in the question. –  r.v Aug 10 '13 at 16:53
    
@r.v - I understand I was putting all the things to try for you and others that may encounter this Q&A down the road. –  slm Aug 10 '13 at 16:54
    
No problem and thanks for helping. –  r.v Aug 10 '13 at 16:58

This was indeed a firewall problem (this was likely the issue because ssh was always working). Although iptables was disabled, Fedora is now coming with firewalld as well this also had to be disabled.

$ sudo service firewalld stop

firewalld became the default since Fedora 18 and the upgrade changed some firewall settings, which need to be fixed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.