Configuring a port setting on Linux server

Question

I'm trying to allow Internet traffic to port 7778 on my server, but am unable to do it correctly. Probably making some rookie mistake here. Can you help me diagnose and solve the issue?

I simply did the following:

sudo iptables -A TCP -p tcp -m tcp --dport 7778 -j ACCEPT

If I do iptables -S, I do see the rule appended in the list, e.g.:

-A TCP -p tcp -m tcp --dport 22 -j ACCEPT
-A TCP -p tcp -m tcp --dport 80 -j ACCEPT
-A TCP -p tcp -m tcp --dport 443 -j ACCEPT
-A TCP -p tcp -m tcp --dport 7778 -j ACCEPT

However, if I ping this particular port from another server - telnet example.com 7778, I see:

telnet: Unable to connect to remote host: Connection refused

What else can I do here? Port 80, 443 and 22 are working correctly FYI.

Note: my server uses Azure infrastructure (classic VM). An extra step I took was adding an endpoint for port 7778 in the Azure portal. Thus this part is covered.

@Hanginoninquietdesperation: there's quite a lot of output, do you need to see everything? Is it secure if I paste it publicly here? — Hassan Baig, Dec 22 '16 at 16:23
@Walter-MSFT: no, so far I've tried it remotely. I just tried it from inside the VM - and got `telnet: Unable to connect to remote host: Connection refused`. Very peculiar! — Hassan Baig, Dec 23 '16 at 02:21
According to the error, it seems that your service is not listening. — Shui shengbao, Dec 23 '16 at 02:44
@Walter-MSFT: would having installed `fail2ban` have anything to do with btw? — Hassan Baig, Dec 23 '16 at 02:58
Hi, whether your port is listening? Or you don't install the app? — Shui shengbao, Dec 23 '16 at 03:02
Possible duplicate of [What causes the 'Connection Refused' message?](http://serverfault.com/questions/725262/what-causes-the-connection-refused-message) — user9517, Dec 23 '16 at 04:51

score 3 · Accepted Answer · answered Dec 22 '16 at 16:40

3

By using the -A switch you have added your rule to the end of the chain. This will almost certainly have placed it after the rule that drops/blocks packets.

When iptables/netfilter is checking to see how a packet should be acted upon. the first to match wins. In your case it will likely match a line like -A INPUT -j REJECT --reject-with icmp-port-unreachable which will cause a Connection Refused message prior to matching your allow messages.

The solution is to use insert the rule using -I into a suitable place in your INPUT chain.

answered Dec 22 '16 at 16:40

user9517

115,471
20
215
297

Makes sense, although the reject rule is above the rule for port `80` and `443` as well (see edited lines in question). Should that have blocked those ports as well? – Hassan Baig Dec 22 '16 at 16:58
Unless, as seems likely there is an earlier rule that allows them. – user9517 Dec 22 '16 at 17:18
Well I pasted the full list of rules in the question; just trying to understand what's what before I insert the rule with `-I` (in case something goes wrong). As you can see, I'm using nginx `fail2ban` as well. – Hassan Baig Dec 22 '16 at 17:23
I executed `sudo iptables -I INPUT 1 -p tcp -m tcp --dport 7778 -j ACCEPT`, however `telnet example.com 7778` still fails. Something very weird is going on over here. Any pointers on diagnosing this? – Hassan Baig Dec 23 '16 at 00:04

Shui shengbao · Answer 2 · 2016-12-23T02:58:45.423

2

According to the error log, it seems that your service is not listening.

To troubleshoot this issue more efficiently, I suggested check as the following ways:

1.Check service in your VM.

netstat -ant|grep 7778

Please ensure the port is listening.

Test by using localhost IP

telnet 127.0.0.1 7778

Based on my knowledge, if your firewall has some missing configure, you would get the following error.

telnet: Unable to connect to remote host: Connection timed out

edited Dec 23 '16 at 02:58

answered Dec 23 '16 at 02:49

Shui shengbao

3,583
1
11
20

Hmm, when I try `netstat -ant|grep 7778`, nothing results. – Hassan Baig Dec 23 '16 at 03:03
1

You could not telnet a port that is not listening. Maybe you should check why the port is not listening. – Shui shengbao Dec 23 '16 at 03:04
Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance. – Shui shengbao Dec 23 '16 at 07:44
Yep, hold on, I'll get back to you. – Hassan Baig Dec 23 '16 at 12:06
2

Ok, please ensure you could telnet 127.0.0.1 7778 – Shui shengbao Dec 23 '16 at 12:10
You were right, the port was indeed listening but my service was down. All fixed! Thanks for the great help. Both of you guys gave helpful answers. Since @Hanginoninquietdesperation helped me with iptables, I'm marking him as correct. – Hassan Baig Dec 23 '16 at 12:45

Configuring a port setting on Linux server

2 Answers2