IP Tables Help

Issues related to configuring your network
Post Reply
PCJR
Posts: 2
Joined: 2013/12/20 22:17:47

IP Tables Help

Post by PCJR » 2013/12/20 22:29:03

I am running Centos 5.7 final and can not connect to the VM with IPtables started. When I stop IPtables and everything works ok.

How do I fix this?

Here is My iPtables file

Code: Select all

# Generated by iptables-save v1.2.6a on Sun Nov 17 20:08:54 2002
*mangle
:PREROUTING ACCEPT [333910:294144044]
:INPUT ACCEPT [298754:250194661]
:FORWARD ACCEPT [60695:56925734]
:OUTPUT ACCEPT [247336:159281728]
:POSTROUTING ACCEPT [335697:230129744]
COMMIT
# Completed on Sun Nov 17 20:08:54 2002
# Generated by iptables-save v1.2.6a on Sun Nov 17 20:08:54 2002
*nat
:PREROUTING ACCEPT [13075:554329]
:POSTROUTING ACCEPT [136:9017]
:OUTPUT ACCEPT [136:9017]
COMMIT
# Completed on Sun Nov 17 20:08:54 2002
# Generated by iptables-save v1.2.6a on Sun Nov 17 20:08:54 2002
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s 127.0.0.1 -m state --state NEW -j ACCEPT
# -A INPUT -p tcp -m multiport --dports ssh,https,http,49 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -i eth1 -m state --dport https --state NEW -j ACCEPT
-A INPUT -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i lo -m state --state NEW -j ACCEPT
-A FORWARD -i eth0 -m state --state NEW -j ACCEPT
-A FORWARD -i eth1 -m state --state NEW -j ACCEPT
-A FORWARD -j DROP
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -s 127.0.0.1 -m state --state NEW -j ACCEPT
-A OUTPUT -s 127.0.0.1 -m state --state NEW -j ACCEPT
-A OUTPUT -s 127.0.0.1 -m state --state NEW -j ACCEPT
-A OUTPUT -m state --state NEW -j ACCEPT
-A OUTPUT -j DROP
COMMIT
# Completed on Sun Nov 17 20:08:54 2002
IPtables config file

Code: Select all

# Load additional iptables modules (nat helpers)
#   Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES="ip_conntrack_netbios_ns"

# Unload modules on restart and stop
#   Value: yes|no,  default: yes
# This option has to be 'yes' to get to a sane state for a firewall
# restart or stop. Only set to 'no' if there are problems unloading netfilter
# modules.
IPTABLES_MODULES_UNLOAD="yes"

# Save current firewall rules on stop.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
# (e.g. on system shutdown).
IPTABLES_SAVE_ON_STOP="no"

# Save current firewall rules on restart.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
# restarted.
IPTABLES_SAVE_ON_RESTART="no"

# Save (and restore) rule and chain counter.
#   Value: yes|no,  default: no
# Save counters for rules and chains to /etc/sysconfig/iptables if
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
# SAVE_ON_RESTART is enabled.
IPTABLES_SAVE_COUNTER="no"

# Numeric status output
#   Value: yes|no,  default: yes
# Print IP addresses and port numbers in numeric format in the status output.
IPTABLES_STATUS_NUMERIC="yes"

# Verbose status output
#   Value: yes|no,  default: yes
# Print info about the number of packets and bytes plus the "input-" and
# "outputdevice" in the status output.
IPTABLES_STATUS_VERBOSE="no"

# Status output with numbered lines
#   Value: yes|no,  default: yes
# Print a counter/number for every rule in the status output.
IPTABLES_STATUS_LINENUMBERS="yes"

User avatar
TrevorH
Site Admin
Posts: 33202
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: IP Tables Help

Post by TrevorH » 2013/12/20 22:50:25

The line in your /etc/sysconfig/iptables file that would allow ssh access is commented out. Not sure what port 49 is for but you've also commented out http and https access.

Code: Select all

# -A INPUT -p tcp -m multiport --dports ssh,https,http,49 -m state --state NEW -j ACCEPT
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke

PCJR
Posts: 2
Joined: 2013/12/20 22:17:47

Re: IP Tables Help

Post by PCJR » 2013/12/20 23:14:09

Thanks that did it, Also got rid of the 49 dont know what it was either

Post Reply