1

I saved and then rebooted my machine. When I look at the iptables file, it contains the below

[root@server /]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.21 on Sat Feb 24 15:25:25 2018
*raw
:PREROUTING ACCEPT [4:164]
:OUTPUT ACCEPT [3:120]
COMMIT
# Completed on Sat Feb 24 15:25:25 2018
# Generated by iptables-save v1.4.21 on Sat Feb 24 15:25:25 2018
*nat
:PREROUTING ACCEPT [3:124]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Sat Feb 24 15:25:25 2018
# Generated by iptables-save v1.4.21 on Sat Feb 24 15:25:25 2018
*mangle
:PREROUTING ACCEPT [4:164]
:INPUT ACCEPT [4:164]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [3:120]
:POSTROUTING ACCEPT [3:120]
COMMIT
# Completed on Sat Feb 24 15:25:25 2018
# Generated by iptables-save v1.4.21 on Sat Feb 24 15:25:25 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
COMMIT
# Completed on Sat Feb 24 15:25:25 2018

Although I can visit my web server from my machine

[root@server tmp]# wget "http://my_ip_address/"
--2018-02-24 15:28:38--  http://my_ip_address/
Connecting to my_ip_address:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3700 (3.6K) [text/html]
Saving to: 'index.html.6'

100%[======================================================================================================>] 3,700       --.-K/s   in 0s

2018-02-24 15:28:38 (470 MB/s) - 'index.html.6' saved [3700/3700]

I'm still unable to connect to it from the outside. There is something else blocking it. I don't know what else I need to check or if I've even configured iptables correctly.

  • Run sudo nmap -sT -O localhost to see the open ports! – George Udosen Feb 24 '18 at 20:40
  • What do you mean by from the outside? Is this other machine connecting to the website inside of the LAN of the website or outside? Also is firewalld running on this server? I notice this is centos. It will be probable be easier to work with just firewalldthan iptables – kemotep Feb 24 '18 at 20:48
0

Run this command sudo nmap -sT -O localhost to see the list of open ports. You can install telnet [ sudo yum install telnet ] and run telnet my_ip_address.com 80 to see if port 80 is open!

0

The modern way to check the socket status is

ss -tln.

The options to the ss are t for tcp, l for listening, n for numeric. You can pipe it to grep 80

0

If your iptables configuration is actually restored from that file, it's wide open: the raw, nat and mangle tables are all empty and all their built-in chains have the default policy of ACCEPT, and the filter table has also ACCEPT as a default policy on all chains, and an explicit ACCEPT for TCP destination port 80 = http.

In this configuration, iptables is blocking nothing at all, and the explicit ACCEPT rule for TCP/80 becomes effectively just a traffic counter for your HTTP server: the packet & byte counters associated with the rule will count all incoming data for port TCP/80.

First, check your machine's IP address. If it is inside one of the following ranges, there is a NAT layer in the network, somewhere upstream of your system. NAT (Network Address Translation) has a side effect of blocking all incoming connections from the "outside", unless configured to pass through specific ports to a specific "inside" host.

  • 10.0.0.0 ... 10.255.255.255 (RFC 1918)
  • 100.64.0.0 ... 100.127.255.255 (RFC 6598 Carrier-Grade NAT)
  • 172.16.0.0 ... 172.31.255.255 (RFC 1918)
  • 192.168.0.0 ... 192.168.255.255 (RFC 1918)

If your IP address is within one of the RFC 1918 ranges, the NAT might be done by your router/modem/similar device, and you might be able to configure a port forwarding to allow HTTP access to your system from the internet. But if it is within the RFC 6598 range, then the NAT is very likely managed by your internet service provider, and you're unlikely to be able to add port forwardings to it.

  • My IP address is 68.66.205.103 . It doesn't appear to be in any of these tables. INteresetingly, although I can access 68.66.205.103 on my phone when not connected to WiFi, when I connect to WiFi through either a Comcast or RCN ISP, I can no longer connect. Not sure what that means. – Dave Feb 25 '18 at 4:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.