Unable to connect to apache from the web

Question

I have an apache instance running with vhost configured, here is the httpd.conf:

#Listen {the_server_ip}:80
Listen 80
#
<VirtualHost *:80>
    ServerAdmin webmaster@example.com
    DocumentRoot /var/www/example.com
    ServerName example.com
    ServerAlias www.example.com
    ErrorLog logs/example.com-error_log
    CustomLog logs/example.com-access_log common
</VirtualHost>

Here is the record in the /etc/hosts:

127.0.0.1 example.com www.example.com

The server is running and listening:

Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 :::80                       :::*                        LISTEN      8756/httpd

Here is CURL request from the server:

[root@localhost example]# curl -I http://example.com/index.html

HTTP/1.1 200 OK
Date: Tue, 01 Mar 2016 11:12:47 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 01 Mar 2016 11:12:12 GMT
ETag: "8aaa-5-52cfad64b4dbe"
Accept-Ranges: bytes
Content-Length: 5
Connection: close
Content-Type: text/html; charset=UTF-8

Here are my iptables rules for INPUT chain:

Chain INPUT (policy DROP 30 packets, 2242 bytes)
 pkts bytes target     prot opt in     out     source               destination
  195  150K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
  185 15126 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
37508  101M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
  192 11152 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
   64  3116 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80

Here are my iptables rules for the OUTPUT chain:

Chain OUTPUT (policy DROP 3 packets, 152 bytes)
 pkts bytes target     prot opt in     out     source               destination
  199  151K ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
16220 3289K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:22
  692 47470 ACCEPT     udp  --  *      *       0.0.0.0/0            8.8.8.8             udp dpt:53
  107  8636 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
14164  603K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
  430 18880 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443

TCPDUMP:

[root@localhost iwanttobesysadmin.com]# tcpdump -v port 80 and host {home_ip}
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
3 packets captured
3 packets received by filter
0 packets dropped by kernel

I am also not able to telnet from my Windows machine on port 80 on the server, but it is ping-able. I believe that there is some restriction in the INPUT chain firewall rules.

What telnet command are you using and message do you get from telnet ? — user9517, Mar 01 '16 at 11:28
I am running the: **telnet {the_server_ip} 80** `The message: Connecting To {the_server_ip}...Could not open connection to the host, on port 80: Connect failed` — Georgi Tsvetanov Tsenov, Mar 01 '16 at 11:31
I have noticed that the server listens on :::80 which is localhost for IPv6? Any idea how to switch to listen on all interfaces, but for IPv4 port 80? — Georgi Tsvetanov Tsenov, Mar 01 '16 at 11:38
Try 'tcpdump port 80 and host {your_windows_machine_ip}' on the server and then use telnet and watch if your packets going in and out. — AlexD, Mar 01 '16 at 11:41
Can you verify with tcpdump that your server is indeed reachable on other TCP ports (eg. ssh)? — AlexD, Mar 01 '16 at 11:56
I am PuTTY-ing from my Windows PC to the server on port 22, so it is reachable I believe — Georgi Tsvetanov Tsenov, Mar 01 '16 at 11:59
If you are hosting your server in the cloud you probably also need to check external firewall rules like Amazon Security Groups — AlexD, Mar 01 '16 at 12:00
@GeorgiTsvetanovTsenov `:::80` is *all ipv6 interfaces on port 80*, and often implies all ipv4 interfaces as well. `::1:80` is *localhost ipv6 only*. — MadHatter, Mar 01 '16 at 12:01
Could you add a rule to your output chain as follows: `iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT`, and report back? — MadHatter, Mar 01 '16 at 12:03
It is still better to verify using ssh that you are testing correct interface with tcpdump and you still can connect. — AlexD, Mar 01 '16 at 12:15
@MadHatter Thank you m8! The iptables rule made the connection successful! — Georgi Tsvetanov Tsenov, Mar 01 '16 at 13:41
@GeorgiTsvetanovTsenov I have written that up as an answer, so you can accept it, and the question can be put to bed (as it were). — MadHatter, Mar 01 '16 at 14:39

score 3 · Accepted Answer · answered Mar 01 '16 at 14:37

3

"I believe that there is some restriction in the INPUT chain firewall rules."

You believe wrongly. There is, however, a problem in the OUTPUT chain, because although you're letting people in to talk to your web server, you're not letting the responses back out.

You added a stateful output rule, to permit that traffic, with

iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

and all now works.

answered Mar 01 '16 at 14:37

MadHatter

79,770
20
184
232

Absolutely true :) – Georgi Tsvetanov Tsenov Mar 01 '16 at 15:08

Unable to connect to apache from the web

1 Answers1