1

I have Ubuntu 12.04 Server installed and serving a Ruby on Rails app with Apache and Passenger. I'm using iptables to control traffic. Yesterday, I setup Apache to use SSL for the site. After setting it up, I realized that I couldn't access the website because port 443 was closed, even though I specifically opened it. The odd thing is if I reload the below rules back into iptables, the port will suddenly open and I can access the site from https. However, if I reboot the server, the port remains closed until I reload the rules again. I've tried to troubleshoot Apache as best I can, and also moved my rule to open 443 around in order to root out any conflicts. But nothing worked, there are no errors and I don't know where else to look. I'm hoping someone here will have an answer. Below are my iptables rules.

*filter

#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.0/8 -j REJECT

#  Accept all established inbound connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#  Allow all outbound traffic - you can modify this to only allow certain traffic
-A OUTPUT -j ACCEPT

#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

# Allow traffic for Nagios
-A INPUT -p tcp --dport 5666 -j ACCEPT

# Allow traffic for Munin
-A INPUT -p tcp --dport 4949 -j ACCEPT

#  Allow SSH connections
#
#  The -dport number should be the same port number you set in sshd_config
#
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

#  Allow ping
-A INPUT -p icmp -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Drop all other inbound - default deny unless explicitly allowed policy
-A INPUT -j DROP
-A FORWARD -j DROP

COMMIT
2
  • 1
    What do you mean by the port is "closed?" Is it being blocked by the firewall or is the application not listening on an incoming socket? How have you verified this? May 16, 2013 at 0:28
  • After rebooting the server, trying to access the site at https will time out. Also, if I check the port using this site, it says port 443 is closed. After I reload the rules, then the site is accesible and the above link says the port is open. May 16, 2013 at 4:10

1 Answer 1

1

The rules in the startup rules file are just that, startup rules. Changes can be made to the rules after startup by you or any other process with root privileges. Run iptables-save (or iptables -L if you don't have -save) from a console to see what the rules currently are, while the problem is occurring, and you'll find a rule blocking your traffic. Determining where that rule is coming from is a much more daunting task. At the simplest level, there could just be an iptables -I ... port 443 DENY somewhere later in your init scripts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .