A web application running on CentOS 7 (app server) in a private LAN needs to make database connections to another CentOS 7 server (database server) running on the same private LAN.

When I type systemctl stop firewalld on the app server, the database connections to the remote database server work perfectly. But when I type systemctl start firewalld on the same application server, the web application is no longer able to connect to the remote database server.

This tells me that I need to create an outbound firewalld rule on the application server. But that would require knowing what port needs to be used for the outbound connections.

What specific commands can be used to determine which port is being used in the application server to make remote connections to the database server?



To see all network ports that have programs listening on them, use: sudo netstat -lpn4

  • -l: Show only listening
  • -p: Show program names
  • -n: Always show port numbers
  • -4: Show only IPv4 network connections

Find your program in the PID/Program name column, then look at which Local Address it's using.

You can read about other options in the manual using man netstat.

  • The web application is not listed in results for sudo netstat -lpn4. The web app is not able to make connections, but CentOS 7 needs to be configured to allow the web app to make connections. This OP asks what commands to use to identify what needs to be ADDED to the list whose contents would be listed by your sudo netstat -lpn4 command. Does this help you clarify a better answer? – CodeMed May 19 '17 at 20:25
  • The answer that I am looking for might involve tailing a log. But then the question is which log? And with what syntax? I would then trigger the web app to make the remote database call, which would add entries to the log including the port being used for the call. I would then add that port to a firewall rule, which would enable the calls to the remote database server to succeed. Is this clear? – CodeMed May 19 '17 at 20:31
  • Perhaps the web app is listening on an IPv6 address, in which case, you must use: 'netstat -lpn6'. – Hydraxan14 May 19 '17 at 21:06
  • I am asking how to tail a log to get a tangible record of a specific request. Can you do that? – CodeMed May 19 '17 at 21:48
  • I don't think the system keeps logs of network connections, so you'll have to look at the log files for your application, assuming it logs such events. They're usually stored somewhere under /var/log. You may also want to look at the journalctl tool. – Hydraxan14 May 19 '17 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.