--- title: "Open or close a port with iptables" description: "Open, close, or block a port on a Linux node with iptables, for everyone or one address, and save the rules so they stay after a reboot." content_type: "how-to" product: "node" platform: "MyAccount" url: "/myaccount/node/how-to/open-or-close-a-port-with-iptables/" topic: ["access-and-security"] --- # Open or close a port with iptables Open or close a port in iptables on a Linux node, for every address or for one address only. The rules are saved, so they stay after a reboot. iptables is the firewall built into Linux. It comes installed on almost every Linux distribution, Ubuntu and CentOS included. Allow only the ports you need, to everyone or to one address, and the node stays safer. Traffic reaches a service on the node only when both its security group and iptables allow it. E2E recommends security groups alone, because a firewall inside the node can conflict with their rules. If you hit such a conflict, use **Allow All Traffic** on the node's **Security Group** tab while you sort it out. **Allow All Traffic** attaches a security group that opens every port. Detach it as soon as you have found the conflict. See [Security Group](/myaccount/security-group/). Firewall is a different product: an appliance your traffic passes through, not rules inside one node. See [Firewall](/myaccount/firewall/). ## Before you begin You need: - A Linux node running Ubuntu or CentOS, with iptables installed. - A user with sudo access, signed in to the node over SSH. See [Connect to a Linux node](/myaccount/node/how-to/connect-to-a-linux-node/). If a rule cuts off your SSH session, you can still sign in from the node's console. See [Open a node's console](/myaccount/node/how-to/open-the-node-console/). ## List the current rules To see the rules iptables uses now, run: ```bash sudo iptables -L ``` The output lists every rule, grouped into chains. **INPUT** holds the rules for traffic coming in to the node, **FORWARD** for traffic passing through it, and **OUTPUT** for traffic going out. Each chain shows its policy, which applies to traffic that no rule matches. On this example node, **INPUT** drops incoming traffic by default and accepts SSH, HTTP, HTTPS, port 1167, and the Zabbix agent: ```text root@e2e:~# iptables -L Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:1167 ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:zabbix-agent Chain FORWARD (policy DROP) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination root@e2e:~# ``` ## Back up the rules Before you change anything, save a copy of the current rules. If a change causes a problem, you can put the old rules back from this file: ```bash sudo iptables-save > IPtablesbackup.txt ``` The file is written to the folder you are in. ## Open a port To accept incoming connections to a port from any address, run this, with the port number in place of ``: ```bash sudo iptables -A INPUT -p tcp --dport -j ACCEPT ``` For example, to open port 8080 for Tomcat to everyone, run: ```bash sudo iptables -A INPUT -p tcp --dport 8080 -j ACCEPT ``` Run `sudo iptables -L -n` to see the new rule at the end of the **INPUT** chain. The `-n` option shows port numbers. Without it, iptables shows a port by its service name from `/etc/services` where it has one, such as `ssh` for port 22: ```text root@e2e:~# iptables -L -n Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:443 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:1167 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:10050 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 Chain FORWARD (policy DROP) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination root@e2e:~# ``` ### Open a port to one address only To keep the port closed to everyone except one address, run this instead. Put the address you allow in place of ``, such as `203.0.113.10`, and the port number in place of ``: ```bash sudo iptables -A INPUT -p tcp -s --dport -j ACCEPT ``` ## Close a port you opened To remove a rule you added, run the same command with `-D` in place of `-A`. Put the port number in place of ``: ```bash sudo iptables -D INPUT -p tcp --dport -j ACCEPT ``` ## Block an outgoing port To stop the node from connecting out to a port on any address, run this, with the port number in place of ``: ```bash sudo iptables -A OUTPUT -p tcp --dport -j DROP ``` To block the port only toward one address, run this. Put that address in place of ``, such as `203.0.113.10`, and the port number in place of ``: ```bash sudo iptables -A OUTPUT -p tcp -d --dport -j DROP ``` ## Save the rules so that they stay after a reboot The rules you add stay in force only until the node restarts. To keep them, save them. Ubuntu saves them with iptables-persistent, which loads the saved rules again at every restart. CentOS saves them with the iptables save command. On Ubuntu, install iptables-persistent once, before you save: ```bash sudo apt install iptables-persistent ``` On Ubuntu 14.04, save and reload the rules with: ```bash sudo /etc/init.d/iptables-persistent save sudo /etc/init.d/iptables-persistent reload ``` On Ubuntu 16.04 and later, use: ```bash sudo netfilter-persistent save sudo netfilter-persistent reload ``` On CentOS, as root, use: ```bash service iptables save ``` ## Check the rules Run `sudo iptables -L` once more. Each rule you added shows in its chain. An opened port is an **ACCEPT** line in **INPUT**. A blocked outgoing port is a **DROP** line in **OUTPUT**. A rule you removed is gone from the list. ## Restore the rules from the backup If a change causes a problem, put back the rules you saved before you started: ```bash sudo iptables-restore < IPtablesbackup.txt ``` The node now accepts only the ports you chose, from everyone or from one address, and keeps the rules after a reboot. Open the same ports in the node's security group too, so traffic reaches them; see [Security Group](/myaccount/security-group/). For help with a port that does not answer, see [Troubleshooting node networking and connectivity](/myaccount/node/troubleshooting/networking-and-connectivity/).