0

I use iptables on Centos 7 but i cant update or install packets while iptables is enabled. Which port must be accepted in iptables to allow yum update/install ?

  • by default you should be able to update/install, did you change anythings in your firewall ? – Wissam Roujoulah Dec 27 '16 at 13:31
  • i deny all except ssh, i dont know which port open to allow update/install – user203520 Dec 27 '16 at 13:38
  • what is your default zone ? – Wissam Roujoulah Dec 27 '16 at 13:43
0

yum uses TCP port 80 by default. You can add a rule into IP tables like this:

# iptables -I INPUT 5 -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

If needed, change your interface from eth0 to em0. Make sure that rule you added is above your reject rule.

Sources:

https://www.centos.org/forums/viewtopic.php?t=30338

http://www.binarytides.com/open-http-port-iptables-centos/

0

If your policy is drop, then you need to add these rules.

as a user with privileges:

modprobe conntrack

iptables -I INPUT 6 -p tcp -m tcp --sport http -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "http input port 80"

iptables -I OUTPUT 6 -p tcp -m tcp --dport http -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "http output port 80"

HTTP means port (80)

comments allow you to identify the rules on IPtables.

0

Added these rules and always blocked when i try update/install :

iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT iptables -t filter -A OUTPUT -p tcp --sport 80 -j ACCEPT

Have you an idea ?

0

Recently added some rules for ports 53,80,443 but i still cannot update/install. Heres the script i use to set the rules :

#!/bin/sh

# flush all
iptables -t filter -F
iptables -t filter -X

# Deny i/o
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

# Established co
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

# ICMP
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A OUTPUT -p icmp -j ACCEPT

# SSH
iptables -t filter -A INPUT -p tcp --dport 666 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 666 -j ACCEPT

# DNS
iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 53  -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --sport 53 -j ACCEPT

# FTP
iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 20:21 -j ACCEPT

# HTTP/S
iptables -t filter -A INPUT -p tcp --dport 80:443 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 80:443 -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.