iptables pitfall

An important thing to remember about rulesets in /etc/sysconfig/iptables is that they are chains. The first rule is applied, followed by the second, and so on. It’s the opposite of CSS that way. More specific rules should go first, while all-encompassing rules should go last.

I was trying to open the usual DB2 ports on RHEL. For some reason, nothing was working.

It turned out that this line was at fault:

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

This rejects all incoming traffic not otherwise allowed. The line has to go last in the file, after all the open port definitions.

One thought on “iptables pitfall

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.