iptables webserver problem

NicK2oo6 · 01-29-2014, 10:36 AM

Hello.
I have a webserver that works fine (localhost and local ip), but when I want to acces it from its public ip, it doesnt work.
I tried eveything, it just doest work. Only if I stop iptables, it starts to work.
I`m using CentOS 6.5 x86
Maybe its from a port forwarding or it doesnt allow to communicate to www. Please explain me how to solve this. (I`m new).

THANKS!!!

Ser Olmy · 01-29-2014, 10:57 AM

Well, if it works when you clear the iptables setup, that must be where the problem is. I guess you'd better find the rules causing the problem, and remove or change them.

If you'd like some help with that, please post your current iptables ruleset. After all, most of us aren't clairvoyant.

(The output from iptables-save would be ideal. Please put it in [code] tags, as it makes it easy to read.)

NicK2oo6 · 01-29-2014, 11:29 AM

Thanks for replying Ser. I`m new to all of the linux world, so...

It`s the default iptables (fresh install)

Code:

# Generated by iptables-save v1.4.7 on Wed Jan 29 19:28:10 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [9023:7887709]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -j REJECT --reject-with icmp-host-prohibited 
-A FORWARD -j REJECT --reject-with icmp-host-prohibited 
COMMIT
# Completed on Wed Jan 29 19:28:10 2014

Ser Olmy · 01-29-2014, 01:46 PM

Perfect. It seems the default ruleset allows ICMP (ping) and incoming SSH (for remote administration), but nothing else. I've added some highlighted rules that would permit incoming traffic to the webserver on ports 80 and 443. (If you only use one of those ports, remove the rule you don't need.)

Code:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [9023:7887709]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

To add these rules, you could do one of the following:

Save the above to a file, run iptables-restore < filename to load the rules into memory, verify that they work, and then save everything with /sbin/service iptables save
Run the following commands in sequence, which will add rules 5 and 6 to the existing ruleset and then save:
- iptables -I INPUT 5 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
- iptables -I INPUT 6 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
- /sbin/service iptables save
(Again, you may want to verify that everything works properly before entering that last "save" command.)
Edit the file /etc/sysconfig/iptables, which I believe contain the iptables ruleset on CentOS systems
Locate the CentOS GUI for editing firewall settings and add the rules from there