ag@linux:~$

history 36 of 36

Opening Firewall Ports with iptables

Opening ports 80, 110 and 143 by editing /etc/sysconfig/iptables, restarting the service and checking the rules, plus firewalld and ufw equivalents.

Written

From my Linux study notes, 2018. Some commands and versions here are old, so please reuse them carefully. Anything marked "added later", and the notes at the end, explain what has changed since.

These notes show how I opened ports in the iptables firewall on a Red Hat-family server by editing its saved rules file. The ports are:

  • 80: HTTP (web server)
  • 110: POP3 (collecting email)
  • 143: IMAP (reading email)

Before you start

  • Run the commands as root or with sudo.

  • If you manage the server over SSH, be careful: a mistake in the firewall file can lock you out. Keep a second session open, or have console access, while you test.

  • Make a backup of the rules file first (added later):

    Terminal window
    cp /etc/sysconfig/iptables /etc/sysconfig/iptables.bak

Open port 80

Open the file /etc/sysconfig/iptables:

Terminal window
vi /etc/sysconfig/iptables

Append the rule as follows:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

What the rule means (added later):

  • -A RH-Firewall-1-INPUT adds the rule to the chain called RH-Firewall-1-INPUT.
  • -m state --state NEW matches new incoming connections.
  • -m tcp -p tcp --dport 80 matches TCP traffic to port 80.
  • -j ACCEPT allows it.

Note (added later): “append” here means add the line among the other ACCEPT rules, before the final REJECT line in that chain and before COMMIT. iptables checks rules from top to bottom, so a rule placed after the REJECT line is never reached.

Note (added later): the RH-Firewall-1-INPUT chain is from the default firewall on CentOS 5. On CentOS 6 the default file uses the built-in INPUT chain instead, so the same rule there is:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

Open your file and use the chain name you see in the existing rules.

Save and close the file. Restart iptables:

Terminal window
/etc/init.d/iptables restart

Open port 110

Append the rule as follows:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 110 -j ACCEPT

Open port 143

Append the rule as follows:

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 143 -j ACCEPT

Restart the iptables service

Type the following command:

Terminal window
service iptables restart

This does the same as /etc/init.d/iptables restart above: it reloads the rules from /etc/sysconfig/iptables.

Verify that the port is open

Run the following command:

Terminal window
netstat -tulpn | less

This lists the ports that programs are listening on (-t TCP, -u UDP, -l listening, -p program name, -n numbers instead of names). A port only accepts connections if a service is listening on it, so check that your web or mail server appears here.

Make sure iptables is allowing port 80 / 110 / 143 connections:

Terminal window
iptables -L -n

-L lists the rules and -n shows numbers instead of looking up names. Add --line-numbers to see the order the rules are checked in.

Refer to the iptables man page for more information about iptables usage and syntax:

Terminal window
man iptables

Notes for today

  • CentOS 5 reached end of life on 31 March 2017 and CentOS 6 on 30 November 2020. Rocky Linux and AlmaLinux are the common free replacements.
  • On newer systems netstat may not be installed. ss -tulpn shows the same information.
  • Security: ports 110 (POP3) and 143 (IMAP) send passwords unencrypted unless the mail server enforces STARTTLS. Today, mail clients usually use the encrypted ports 995 (POP3S) and 993 (IMAPS) instead. Open only the ports you need.

firewalld (Rocky Linux, AlmaLinux, CentOS 7 and later)

Red Hat-family systems now use firewalld, managed with firewall-cmd. The equivalent of the rules above:

Terminal window
sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=110/tcp
sudo firewall-cmd --permanent --add-port=143/tcp
sudo firewall-cmd --reload

You can also open a port by its service name, for example sudo firewall-cmd --permanent --add-service=http. --permanent saves the rule; --reload makes saved rules active. To check what is open:

Terminal window
sudo firewall-cmd --list-all

ufw (Ubuntu)

Ubuntu commonly uses ufw:

Terminal window
sudo ufw allow 80/tcp
sudo ufw allow 110/tcp
sudo ufw allow 143/tcp
sudo ufw status

If ufw is not yet enabled, allow SSH first (sudo ufw allow OpenSSH) and then run sudo ufw enable, or you may lock yourself out of a remote server.