3

When installing RHEL, iptables seems to be rejecting connections from 1531 (oracle). This is my configuration:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

I need to interpret these rules to understand why port 1531 is not accepted. I can see there is no ACCEPT for it, but I don't see any "REJECT ALL" type of statements either.

4
  • any other firewalls in the middle?
    – lese
    Dec 17, 2015 at 18:16
  • How can you tell if iptables is rejecting the connection? Have you turned off your iptables to confirm that?
    – ryekayo
    Dec 17, 2015 at 18:28
  • You want to connect to 1531 during installation? Dec 17, 2015 at 18:28
  • @lese lol. yes but the port is open. ryekayo I have stopped the iptables service and it works. AloisMahdal The server is installed already this is a problem arising after a reboot. Dec 17, 2015 at 19:00

2 Answers 2

4

This is the same file, not the actual firewall rules in the kernel, but they appear here in the same order they would in a running firewall. What is happening in this case is that the incoming packets traverse all rules in the INPUT chain one-by-one, and keep falling through until they hit the rule that is saved as -A INPUT -j REJECT --reject-with icmp-host-prohibited. At this point, they are rejected by the firewall.

You can solve this by either inserting an ACCEPT rule before this REJECT rule, or by disabling the firewall entirely.

The confusion comes from the default policy being ACCEPT; in many security circles, the preferred logic would be to remove the explicit REJECT rules and simply set the default policy on the chain to REJECT or DROP. To see the active firewall rules at any given time, you can use iptables -L. To update the firewall, I strongly recommend the following procedure:

  1. Set a "timer" that will reset the firewall state in 5 minutes (e.g. echo "service iptables restart" | at now + 5 minutes)
  2. Modify the in-kernel firewall ruleset and confirm that your modifications work as desired without any undesired side effects. If you lock yourself out, wait 5 minutes until your timer expires and resets your firewall.
  3. Save the modified ruleset via service iptables save
6
  • This is a really good answer. Thank you for explaining firewall logic in such simple terms. If I could upvote twice I would! Dec 17, 2015 at 19:03
  • Would a -A INPUT -p icmp REJECT --reject-with icmp-host-prohibited also solve the problem? Dec 17, 2015 at 19:04
  • No, it wouldn't, because you need to somehow ACCEPT the connection for the Oracle port, not add another thing to REJECT. The only thing your new rule would do is to REJECT all ICMP packets and send an "icmp-host-prohibited" message to the sender - basically, this would disable ping'ing of this machine from any other machines.
    – John
    Dec 17, 2015 at 19:18
  • I was thinking of modifying the current REJECT rule rather than adding a more specific rule. Since TCP port 1531 goes through all the way to that REJECT, restricting to ICMP would let it through and block only pings. Dec 17, 2015 at 19:38
  • I think you'd be better off removing the REJECT rules, adding an ACCEPT to port 1531, and making the chain policy DROP.
    – John
    Dec 17, 2015 at 19:40
1

It looks as though the port is not configured in your iptables. That looks like the default iptables file and I think iptables uses an implicit deny so you have to explicitly state the ports you wish to allow.

You can manually edit it by inserting a line before the REJECT statements like this:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 1531 -j ACCEPT

When finished, restart iptables:

RedHat 6.x: service iptables restart

Redhat 7.x: systemctl restart iptables.service

Keep in mind I primarily deal with CentOS, which is sort of the same thing... There are other ways to open the port (through the command line) but that is easily researched on your own.

2
  • 1
    There's no implicit deny here, the chain's policy is ACCEPT, but the REJECT line matches everything, it's an explicit well-behaved deny. Dec 17, 2015 at 23:51
  • @Gilles, yes that is probably the correct way to assert it. Thanks! Dec 18, 2015 at 12:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .