17

I created an Ubuntu instance on Oracle Cloud Infrastructure (OCI). I am able to connect to this instance with SSH (TCP 22). I created some services on this instance, like daytime (TCP 13), mail (TCP 25), http (TCP 80), dns (TCP/UDP 53). I added similar rules to the Default Security List on the OCI management web page of this instance similar to the default SSH rule. However, when I try to connect to any of these services from Internet I get No route to host error. The only exception is the SSH service which works with no problem.

Once I had installed ufw to this instance; however, later I disabled and removed ufw. After that, I removed iptables package also. So, now there is no Linux firewall at all. However, I still have this problem.

This seems to be an OCI-related problem. I had done similar configurations in other cloud platforms (AWS, GCP, etc.) with no problem.

Where else can I look to isolate this problem?

Update: Removing iptables and rebooting solved the problem. Now I will try to re-install iptables.

FedKad
  • 535
  • 1
  • 3
  • 17

6 Answers6

12

The problem seems to be related to OCI not wanting you to use ufw in Ubuntu: https://docs.oracle.com/en-us/iaas/Content/Compute/known-issues.htm#ufw

I have to disable or remove ufw and edit the file /etc/iptables/rules.v4 as described in the link given above. After that, to enable the new rules, I need to run:

# iptables-restore </etc/iptables/rules.v4

It seems that the ufw rules do not have any effect in such a configuration and I have to use iptables. This is, however, not a very user-friendly way to manage the firewall rules on an Ubuntu server on OCI platform.

neitsab
  • 137
FedKad
  • 535
  • 1
  • 3
  • 17
9

I found this issue with Oracle Linux in Oracle cloud. It has predefined set of blocking rules. So I was succesfully connecting 22 port (ssh), but was getting "No route to host" trying to connect other ports.
You need to open ports individually:

Ex, for Docker:

firewall-cmd  --permanent --zone=public --add-port=2377/tcp
firewall-cmd  --reload

Also, you need to setup security list for virtual cloud network.

MarianD
  • 2,726
Alexey Petushkov
  • 251
8

These are the exact steps that worked for me, based on FedKad's answer to his original post...

The following extra steps were needed on the Oracle cloud, to open up ports on Ubuntu 20:

  1. sudo vim /etc/iptables/rules.v4 (or whatever editor you use)

  2. After the line -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT , insert:

-A INPUT -p tcp -m state --state NEW -m tcp --dport 1234 -j ACCEPT

(change the number of the port that needs to be opened!)

  1. At the shell prompt:

sudo su -

iptables-restore < /etc/iptables/rules.v4

exit

  1. The newly-opened port may be tested by going on another Linux machine, and issuing the command:

nc -zvw100 THE_IP_ADDRESS_OF_MACHINE_WHOSE_PORT_WE_OPENED THE_PORT_NUMBER

Julian - BrainAnnex.org
  • 181
5
nano /etc/iptables/rules.v4

Add below lines

-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

iptables-restore < /etc/iptables/rules.v4
gronostaj
  • 58,482
Karthikeyan s
  • 51
1

It can be in the network or in the Linux instance. And if it is in Linux, it can be the iptables or the service.

To start wit the last one, and because you have mail, try on the Linux box:

telnet 127.0.0.1 smtp
helo there
quit

Do you see 220, 250 and 221 messages? Then your mail service works. If you get Connection refused, then your service is not up and running.

Next, iptables -nvL should tell you if the ports are open for the outside world. If you cab't make heads -or tails of the output,

service iptables stop

should stop iptables, which for a test might be acceptable. You said that you got rid of ufw, so I assume sudo ufw disable won't be needed anymore.

If, with iptables out of the way, you are still not able to connect, it is probably a setting in the Amazon cloud, with which I have no experience.

Ljm Dullaart
  • 2,788
0

Similar problem in OCI

I added in the inbound rules in

Network / Virtual Cloud Networks / vcn-01 / Security List Details / Inbound Rules

And it still wasn't working.

I added this iptables command and it worked:

sudo iptables -I INPUT 9 -p tcp -s xxx.xxx.xxx.xx --dport xxx -m state --state NEW -j ACCEPT

In my case, I only want to allow a specific address to access a specific port. It is very important that the iptable command uses -I and that the input rule is above the rule that rejects all connections. In my case, INPUT 9 is above the block rule.

Gokupico
  • 1