iptables pitfall

An important thing to remember about rulesets in /etc/sysconfig/iptables is that they are chains. The first rule is applied, followed by the second, and so on. It’s the opposite of CSS that way. More specific rules should go first, while all-encompassing rules should go last.

I was trying to open the usual DB2 ports on RHEL. For some reason, nothing was working.

It turned out that this line was at fault:

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

This rejects all incoming traffic not otherwise allowed. The line has to go last in the file, after all the open port definitions.

Published by

Leons Petrazickis

I'm a full-stack developer at IBM Digital Business Group. I do Ruby, Node, Python, Hadoop, Spark, as well as web scale devops with Docker and Terraform. My opinions are my own.

One thought on “iptables pitfall”

Comments are closed.