iptables pitfall

An important thing to remember about rulesets in /etc/sysconfig/iptables is that they are chains. The first rule is applied, followed by the second, and so on. It’s the opposite of CSS that way. More specific rules should go first, while all-encompassing rules should go last.

I was trying to open the usual DB2 ports on RHEL. For some reason, nothing was working.

It turned out that this line was at fault:

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

This rejects all incoming traffic not otherwise allowed. The line has to go last in the file, after all the open port definitions.

One Comment to “iptables pitfall”

  1. PHP-help » Log Buffer #182, a Carnival of the Vanities for DBAs

    [...] Leons Petrazickis reminds us that “rulesets are chains” and it is important to have your rulesets in the proper order in iptables firewall pitfall. [...]