Does Iptables need ufw to work?

I tried unsuccessfully open 4447 on my ubuntu server 12.10 using iptables.


server:~# iptables -A INPUT -p tcp --dport 4447 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

After that iptables -L:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:4447 state NEW,RELATED,ESTABLISHED
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

But nmap does not show me port 4447:

server:~# nmap -sV localhost
Starting Nmap 6.00 ( http://nmap.org ) at 2013-04-26 12:54 BRT
Nmap scan report for localhost (
Host is up (0.00078s latency).
Not shown: 991 closed ports
22/tcp   open  ssh                    OpenSSH 6.0p1 Debian 3ubuntu1 (protocol 2.0)
139/tcp  open  netbios-ssn            Samba smbd 3.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn            Samba smbd 3.X (workgroup: WORKGROUP)
3306/tcp open  mysql                  MySQL 5.5.31-0ubuntu0.12.10.1
5432/tcp open  postgresql             PostgreSQL DB
8080/tcp open  http                   Apache httpd 2.2.22 ((Ubuntu))

Can someone helps me to fix it?

I did the same steps on another server (CentOS 6) and it worked at a glance

Thanks in advance

  • hi do you try only itptables -A INPUT -p tcp --sport -J ACCEPT .? do you used nmap out from your server? And my recomendation set your default police to DROP just if you know that do. – user152516 Apr 26 '13 at 17:17

Make sure there's actually something listening on port 4447/tcp. Otherwise, if there isn't, nmap won't show this port as open.

You can check this with:

sudo netstat -tpln | grep 4447

If you aren't getting the program name in the output, there's nothing listening on this port.


After OP's clarification it looks like the goal is to redirect incoming TCP connections to a certain port to an alternate port. Such as redirecting incoming connections to 4447/tcp to 3306/tcp where MySQL is listening.

Assuming that your server has the IP address and MySQL is listening on it on 3306/tcp, the way to do what you're after is:

iptables -t nat -A PREROUTING -p tcp --dport 4447 -j DNAT --to-destination
iptables -t nat -A OUTPUT -p tcp -d --dport 4447 -j REDIRECT --to-ports 3306

iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp --dport 4447 -j ACCEPT
  • Hi. Thanks for answers. Even if I do sudo netstat -tpln | grep 4447 still get blank answer from my bash. This didn't work too -A INPUT -p tcp --sport 4447 -j ACCEPT What can I doing wrong? – jordan Apr 29 '13 at 11:59
  • Sorry, "What am I doing wrong" – jordan Apr 29 '13 at 12:07
  • It just doesn't look like there's any application actually listening on this port. Maybe you could let us know what you're trying to achieve, instead of how you're trying to do it. Why do you need to open that port on the firewall in the first place? – Marcin Kaminski May 1 '13 at 16:54
  • Sure, my intension, for instance is redirect 4447 traffic to 3306 port. When I was trying, that question came up : How can I open my ubuntu server port? Since that, I keep searching the answer. On my VM (centos) I just execute thae command and then port is open, but could not achieve the same result on ubuntu. I know that I can change MySql listening port in this case on config files, but Its juste a sample. – jordan May 2 '13 at 11:19
  • I think I understand now what you're trying to achieve and I've updated the answer. Please accept it if you're happy with it. I'll also update your question to include your clarification. Of course you'll be able to review it if you don't think this is what you intended to ask. – Marcin Kaminski May 2 '13 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.