0

A web application running Java on a CentOS 7 server in a private network needs to use Java to make connections with other servers in the same network. Java may automatically choose random ports when making outbound connections from the CentOS 7 server.

What specific syntax would be required to write a Firewalld rule on server 10.0.8.1 that would enable a Java web app running in IP 10.0.8.1 to use any port to establish connections with other servers in the 10.0.8.x network?

The other servers are able to receive connections with rules set up on specific ports, but the web app server's Java needs to be able to use any port.


@garethTheRed's suggestions:

Per @garethTheRed's suggestion, I restarted firewalld and typed firewall-cmd --list-all-zones on the CentOS 7 virtual machine whose Java installation is not able to make outbound database connections to another virtual machine on the same network. The results are as follows:

[root@localhost ~]# firewall-cmd --list-all-zones
work
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

drop
  target: DROP
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

internal
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client mdns samba-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

external
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh
  ports:
  protocols:
  masquerade: yes
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

trusted
  target: ACCEPT
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

home
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client mdns samba-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

dmz
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

block
  target: %%REJECT%%
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

[root@localhost ~]#
  • The servers on 10.0.8.x are listening on a specific port. Simply open that port on those servers. – garethTheRed May 20 '17 at 21:05
  • @garethTheRed The problem is that a Java app (JIRA) on 10.0.8.1 cannot send database calls to a database server at 10.0.8.x UNLESS I 'systemctl stop firewalld' on 10.0.8.1. The vendor for the Java app on 10.0.8.1 says that Java/JIRA chooses random ports with which to reach out to the world. ... And my testing indicates that the 10.0.8.x machines are able to receive incoming Java/JIRA calls through their own firewalls as long as the 10.0.8.1 machine has turned off its firewall. ... The problem is isolated to the OUTBOUND firewall rules on 10.0.8.1 for Java/JIRA. – CodeMed May 20 '17 at 22:15
  • firewalld doesn't block outgoing connections by default. Look at (or add to your question) the output of firewall-cmd --list-all-zones. – garethTheRed May 21 '17 at 7:30
  • @garethTheRed I added the results of firewall-cmd --list-all-zones to the end of the OP. Does this help you see the problem? – CodeMed May 21 '17 at 17:55
  • There's nothing glaringly obvious there that would cause outbound connections to fail (I'm no expert though). You'll know if outbound connections work if you can successfully run yum update as that creates outbound connections to the repositories. Does this application work is a similar way to FTP where the client connects to the server, then the server tries to open a new connection back to the client on an ephemeral port? netstat -tnp or ss -tnp may help you track down which ports are being used. – garethTheRed May 21 '17 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.