1

I was setting up Mathematica on a remote server, and needed access to the UI. I set up VNC according to http://wiki.centos.org/HowTos/VNC-Server , and got it working, which involved making an iptables change. About three minutes later, my phone started buzzing. I was horrified to see this:

enter image description here

These are the lines I appended to /etc/sysconfig/iptables :

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp -m multiport --dports 5901:5903,6001:6003 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

I'm aware of the multiple things wrong with what I did:

  1. Changed a live system. To be fair, it's the one I had Mathematica installed on, and I can only put that on one system as per the terms of use.

  2. Changed a live system.

  3. Changed a live system.

  4. Didn't know what I was doing

So, my question is; what part of this was the part that blocked access to the webserver, and presumably other ports as well?

1

A line beginning with a colon and a rule name, like :INPUT ACCEPT [0:0], resets the corresponding chain: any previous rules are flushed. If you want to add rules, add -A INPUT … lines. There should be a single :CHAIN line for each chain in /etc/sysconfig/iptables, coming before any other rule that references that chain. Thus whatever rules were already there were effectively ignored due to the code you appended.

It's always risky to manipulate the firewall on a remote machine. If you really need to do it, here are a few tips to minimize the risk.

  • Run iptables commands interactively until you're satisfied; don't edit the configuration file without having performed ample testing.
  • Use screen or tmux. When you play with firewall rules, you're likely to get disconnected.
  • Before you make any change, launch the command sleep 60 && iptables-restore </etc/sysconfig/iptables in a screen/tmux window. That way, after a minute, the default settings will be reapplied. If your change goes well, go back to that window and cancel with Ctrl+C.
|improve this answer|||||
  • Excellent answer; I learned why things happened, how to make them happen properly, and some other very useful practices which I will be certain to use in the future. Thank you! :) – Austin Burk Nov 21 '14 at 1:47
1

I found out what happened - the new rule overrode all the previous rules, leaving only the SSH and VNC ports open. I added the VNC rules to the previous config in the file. Solved!

|improve this answer|||||
0

I believe that the icmp protocol is mainly used for pinging and not prohibiting vnc connection. Check whether any webserver ports assigned is not opened in iptables.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.