Open or close a port with iptables

View as Markdown

Open or close a port in iptables on a Linux node, for every address or for one address only. The rules are saved, so they stay after a reboot.

iptables is the firewall built into Linux. It comes installed on almost every Linux distribution, Ubuntu and CentOS included. Allow only the ports you need, to everyone or to one address, and the node stays safer.

Traffic reaches a service on the node only when both its security group and iptables allow it. E2E recommends security groups alone, because a firewall inside the node can conflict with their rules. If you hit such a conflict, use Allow All Traffic on the node’s Security Group tab while you sort it out. Allow All Traffic attaches a security group that opens every port. Detach it as soon as you have found the conflict. See Security Group.

Firewall is a different product: an appliance your traffic passes through, not rules inside one node. See Firewall.

Before you begin

You need:

A Linux node running Ubuntu or CentOS, with iptables installed.
A user with sudo access, signed in to the node over SSH. See Connect to a Linux node.

If a rule cuts off your SSH session, you can still sign in from the node’s console. See Open a node’s console.

List the current rules

To see the rules iptables uses now, run:

sudo iptables -L

The output lists every rule, grouped into chains. INPUT holds the rules for traffic coming in to the node, FORWARD for traffic passing through it, and OUTPUT for traffic going out. Each chain shows its policy, which applies to traffic that no rule matches. On this example node, INPUT drops incoming traffic by default and accepts SSH, HTTP, HTTPS, port 1167, and the Zabbix agent:

root@e2e:~# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:1167
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:zabbix-agent
Chain FORWARD (policy DROP)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
root@e2e:~#

Back up the rules

Before you change anything, save a copy of the current rules. If a change causes a problem, you can put the old rules back from this file:

sudo iptables-save > IPtablesbackup.txt

The file is written to the folder you are in.

Open a port

To accept incoming connections to a port from any address, run this, with the port number in place of <port>:

sudo iptables -A INPUT -p tcp --dport <port> -j ACCEPT

For example, to open port 8080 for Tomcat to everyone, run:

sudo iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

Run sudo iptables -L -n to see the new rule at the end of the INPUT chain. The -n option shows port numbers. Without it, iptables shows a port by its service name from /etc/services where it has one, such as ssh for port 22:

root@e2e:~# iptables -L -n
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:1167
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:10050
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8080
Chain FORWARD (policy DROP)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
root@e2e:~#

Open a port to one address only

To keep the port closed to everyone except one address, run this instead. Put the address you allow in place of <ip-address>, such as 203.0.113.10, and the port number in place of <port>:

sudo iptables -A INPUT -p tcp -s <ip-address> --dport <port> -j ACCEPT

Close a port you opened

To remove a rule you added, run the same command with -D in place of -A. Put the port number in place of <port>:

sudo iptables -D INPUT -p tcp --dport <port> -j ACCEPT

Block an outgoing port

To stop the node from connecting out to a port on any address, run this, with the port number in place of <port>:

sudo iptables -A OUTPUT -p tcp --dport <port> -j DROP

To block the port only toward one address, run this. Put that address in place of <ip-address>, such as 203.0.113.10, and the port number in place of <port>:

sudo iptables -A OUTPUT -p tcp -d <ip-address> --dport <port> -j DROP

Save the rules so that they stay after a reboot

The rules you add stay in force only until the node restarts. To keep them, save them. Ubuntu saves them with iptables-persistent, which loads the saved rules again at every restart. CentOS saves them with the iptables save command.

On Ubuntu, install iptables-persistent once, before you save:

sudo apt install iptables-persistent

On Ubuntu 14.04, save and reload the rules with:

sudo /etc/init.d/iptables-persistent save

sudo /etc/init.d/iptables-persistent reload

On Ubuntu 16.04 and later, use:

sudo netfilter-persistent save

sudo netfilter-persistent reload

On CentOS, as root, use:

service iptables save

Check the rules

Run sudo iptables -L once more. Each rule you added shows in its chain. An opened port is an ACCEPT line in INPUT. A blocked outgoing port is a DROP line in OUTPUT. A rule you removed is gone from the list.

Restore the rules from the backup

If a change causes a problem, put back the rules you saved before you started:

sudo iptables-restore < IPtablesbackup.txt

The node now accepts only the ports you chose, from everyone or from one address, and keeps the rules after a reboot. Open the same ports in the node’s security group too, so traffic reaches them; see Security Group. For help with a port that does not answer, see Troubleshooting node networking and connectivity.