I have a CentOS installation as a guest VM with VirtualBox. I have two ethernet interfaces, eth0 with NAT and DHCP, and eth1 with Host-only adapter and static IP.

I have Oracle installed in this CentOS and I want to open the port of the database 1521 and the port of the Oracle manager (which depends on the db -- in this example 5500). So my

    # Firewall configuration written by system-config-firewall
    # Manual customization of this file is not recommended.
    :INPUT ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    -A INPUT -m state --state ESTABLISHED, RELATED -j ACCEPT
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 1521 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 1158 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 5500 -j ACCEPT
    -A INPUT -m state --state NEW -m tcp -p tcp --dport 465 -j ACCEPT
    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited

And sudo iptables -nvL in the guest VM shows:

            Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination
     266K  103M ACCEPT     all  --  *      *             state RELATED,ESTABLISHED
        1    84 ACCEPT     icmp --  *      *  
     4749  285K ACCEPT     all  --  lo     *  
        3   192 ACCEPT     tcp  --  *      *             state NEW tcp dpt:22
        0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:1521
        0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:1158
     1001  143K REJECT     all  --  *      *             reject-with icmp-host-prohibited

    Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination
        0     0 REJECT     all  --  *      *             reject-with icmp-host-prohibited

    Chain OUTPUT (policy ACCEPT 220K packets, 92M bytes)
     pkts bytes target     prot opt in     out     source               destination

It looks like iptables shows less entries than the ones I have defined in the file.

sudo netstat -apnt | grep 5500 shows that the process is indeed running on 5500:

    tcp        0      0          ESTABLISHED 3332/emagent
    tcp        0      0 :::5500                     :::*                        LISTEN      3323/java
    tcp        0      0 ::ffff:   ::ffff:  ESTABLISHED 3891/oraclesampleDM

I did several telnet oracleserver XXX. It could connect with 22 and 1521, which seem to be the first two that I added in the iptables. It refused to connect in all the rest -- it seems it is using an old version of the file.

But from my host machine, if I open a browser and type https://oracleserver:5500/em/ I get an error.

I have already done sudo iptables restart after having modified the file, and even rebooted the OS.

I have commented the reject lines (to see if there could be a routing problem), and even service iptables stop. I still have the same problem. What is funny is that ssh works from host to guest!

route -n in the guest VM outputs:

    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   U     0      0        0 eth0   U     0      0        0 eth1     U     1002   0        0 eth0     U     1003   0        0 eth1         UG    0      0        0 eth0

Anything weird?

  • I would first verify that it actually is a firewall issue (and not potentially a routing issue) by temporarily deleting the one reject rule from the active iptables config, and testing again. Also, it may be helpful to include -n in your iptables command so the output in your post is a little clearer to people who don't know, for example, what "dbcontrol-oms" is.
    – Bratchley
    Apr 10, 2013 at 20:38
  • Is that listing from the vm or from the host running the vm?
    – ott--
    Apr 10, 2013 at 21:29
  • 1
    Your iptables -L output is definitely missing some of the entries that you show in your config file. Can you redo the iptables -L as iptables -nvL instead? Also if your config file is correct, you should not do an iptables save as this will overwrite the config file with what is currently running.
    – phemmer
    Apr 10, 2013 at 21:55
  • @JoelDavis how can I easily check if there is a routing issue? because if I comment the reject...I still have the same problem as you suggested....I have updated the question with the iptables -nvL. Apr 11, 2013 at 12:36
  • @ott the listing is from the guest VM. Apr 11, 2013 at 12:38

1 Answer 1


This comment by ott-- seems correct. If the screen dump above is complete, the service is only listening to 5500 on IPv6 and it's not listening to 1158 at all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .