An important thing to remember about rulesets in /etc/sysconfig/iptables is that they are chains. The first rule is applied, followed by the second, and so on. It’s the opposite of CSS that way. More specific rules should go first, while all-encompassing rules should go last.
I was trying to open the usual DB2 ports on RHEL. For some reason, nothing was working.
It turned out that this line was at fault:
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
This rejects all incoming traffic not otherwise allowed. The line has to go last in the file, after all the open port definitions.
Leo on Tech 
One thought on “iptables pitfall”