I'm trying to connect to port 25 with netcat from one virtual machine to another but It's telling me no route to host although i can ping. I do have my firewall default policy set to drop but I have an exception to accept traffic for port 25 on that specific subnet. I can connect from VM 3 TO VM 2 on port 25 with nc but not from VM 2 TO 3.

Here's a preview of my firewall rules for VM2


Here's a preview of my firewall rules for VM 3


When I show the listening services I have *:25 which means it's listening for all ipv4 ip addresses and :::25 for ipv6 addresses. I don't understand where the error is and why is not working both firewall rules accept traffic on port 25 so it's supposed to be connecting. I tried comparing the differences between both to see why I can connect from vm3 to vm2 but the configuration is all the same. Any suggestions on what could be the problem?

Update stopping the iptable service resolves the issue but I still need those rules to be present.

  • 7
    Please, avoid screen shots when possible. Instead, edit your question and copy-paste your terminal text. Thanks.
    – xhienne
    Mar 23, 2017 at 23:34

1 Answer 1


Your no route to host while the machine is ping-able is the sign of a firewall that denies you access politely (i.e. with an ICMP message rather than just DROP-ping).

See your REJECT lines? They match the description (REJECT with ICMP xxx). The problem is that those seemingly (#) catch-all REJECT lines are in the middle of your rules, therefore the following rules won't be executed at all. (#) Difficult to say if those are actual catch-all lines, the output of iptables -nvL would be preferable.

Put those REJECT rules at the end and everything should work as expected.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.