Ssh – Opening a firewall port in RHEL 6.8

I am struggling to determine if a specific port is open according to the firewall in Redhat 6.8

I want to open port 2222.

I have tried the following:

system-config-firewall, running as sudo , and I have port 2222 described as a specific port to be opened:

Yet the port does not appear open. I am testing this by trying to connect via SSH to port 2222. Currently SSH runs on port 22, and I can connect fine, but when I configure SSH to run via 2222, using Port 2222 in the sshd_config in /etc/ssh/, the connection times out. I know that SSHD is configured to listen on that port as I can test that using netstat.

I have also tried various edits to /etc/sysconfig/iptables, including adding the following rules:

-I INPUT 9 -m state --state NEW -m tcp -p tcp --dport 2222 -j ACCEPT

and

-A INPUT -m state --state NEW -m tcp -p tcp --dport 2222 -j ACCEPT

After each of these changes I perform sudo service iptables restart and I fail to connect. Interestingly, if I do cat /etc/sysconfig/iptables | grep 2222 I fail to see my new rule in that listing, which I expect I should. I also fail to see it when running sudo iptables -L -n Is that normal?

I have realised that the host is running SELinux – as per this output:

[andyarmstrong@o0201320382301 ~]$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          permissive
Policy version:                 24
Policy from config file:        targeted

I installed semanage, and have run : semanage port -a -t ssh_port_t -p tcp 2222 — but I still don't get through to it.

The whole /etc/sysconfig/iptables file has the following in it:

#GENERATED BY Modular IPTABLES Config
*filter
:FORWARD DROP [0:0]
:INPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 113 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 5308 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5900 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5901 -j ACCEPT
# Sametime File Transfers use ports 443 and 5656
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5656 -j ACCEPT
#VoiceJam Rules
-A INPUT -p udp -m udp --dport 5004:5005 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5004:5005 -j ACCEPT
-A INPUT -p udp -m udp --dport 20830 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20830 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5060:5062 -j ACCEPT
-A INPUT -p udp -m udp --dport 5060:5062 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 12080 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
# CDS Peering #60050
-A INPUT -p tcp -m tcp --dport 21100 -j ACCEPT
# My Help SSL P2P migration
-A INPUT -p tcp -m tcp --dport 2001 -j ACCEPT
-A INPUT -p udp -m udp --dport 2001 -j ACCEPT
-A INPUT -p ah -j ACCEPT
-A INPUT -p esp -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 500 -j ACCEPT
-A INPUT -i ipsec+ -p 254 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 9 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT

# Enable forward between KVM server and virtual machines
-I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -d 192.168.123.0/24 -o virbr1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.123.0/24 -i virbr1 -j ACCEPT
-A FORWARD -i virbr1 -o virbr1 -j ACCEPT
-A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable
# Rule required by package ibm-config-kvm-printing
# Allow printer sharing between Linux host and KVM guests
-A INPUT -i virbr0 -p tcp --dport 631 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8081 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1533 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 52311 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 30000:30005 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 67:68 -j DROP
-A INPUT -p udp -m udp --dport 67:68 -j DROP
-A INPUT -p tcp -m tcp --dport 137 -j DROP
-A INPUT -p udp -m udp --dport 137 -j DROP
-A INPUT -p tcp -m tcp --dport 138 -j DROP
-A INPUT -p udp -m udp --dport 138 -j DROP
-A INPUT -p tcp -m tcp --dport 139 -j DROP
-A INPUT -p udp -m udp --dport 139 -j DROP
-A INPUT -p tcp -m tcp --dport 1:20 -j DROP
-A INPUT -p tcp -m tcp --dport 111 -j DROP
-A INPUT -p tcp -m tcp --dport 161:162 -j DROP
-A INPUT -p tcp -m tcp --dport 520 -j DROP
-A INPUT -p tcp -m tcp --dport 6348:6349 -j DROP
-A INPUT -p tcp -m tcp --dport 6345:6347 -j DROP
-A INPUT -i virbr0 -p tcp -d 192.168.122.1 --dport 445 -j ACCEPT
-A INPUT -i virbr0 -p tcp -d 192.168.122.1 --dport 1445 -j ACCEPT
-A INPUT -i virbr1 -p tcp -d 192.168.123.1 --dport 445 -j ACCEPT
-A INPUT -i virbr1 -p tcp -d 192.168.123.1 --dport 1445 -j ACCEPT
# Accept local Samba connections
-I INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT 
-I INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT 
-I INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT 
-I INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT 
-I INPUT -i virbr0 -p udp -m udp --dport 137 -j ACCEPT
-I INPUT -i virbr0 -p udp -m udp --dport 138 -j ACCEPT
-I INPUT -i virbr0 -p tcp -m tcp --dport 139 -j ACCEPT
-I INPUT -i virbr0 -p tcp -m tcp --dport 445 -j ACCEPT
-I INPUT -i virbr1 -p udp -m udp --dport 53 -j ACCEPT
-I INPUT -i virbr1 -p tcp -m tcp --dport 53 -j ACCEPT
-I INPUT -i virbr1 -p udp -m udp --dport 67 -j ACCEPT
-I INPUT -i virbr1 -p tcp -m tcp --dport 67 -j ACCEPT
-I INPUT -i virbr1 -p udp -m udp --dport 137 -j ACCEPT
-I INPUT -i virbr1 -p udp -m udp --dport 138 -j ACCEPT
-I INPUT -i virbr1 -p tcp -m tcp --dport 139 -j ACCEPT
-I INPUT -i virbr1 -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 48500 -j ACCEPT
-A INPUT -i virbr1 -p tcp -m tcp --dport 48500 -j ACCEPT
-A INPUT -p tcp -m limit --limit 3/min -j LOG --log-prefix "FIREWALL: " --log-level 6
-A INPUT -p udp -m limit --limit 3/min -j LOG --log-prefix "FIREWALL: " --log-level 6
-A INPUT -j DROP
:OUTPUT ACCEPT [0:0]
COMMIT
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
-A POSTROUTING -o virbr1 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
:PREROUTING ACCEPT [0:0]
COMMIT
*nat
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
-A POSTROUTING -s 192.168.123.0/24 ! -d 192.168.123.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.123.0/24 ! -d 192.168.123.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A POSTROUTING -s 192.168.123.0/24 ! -d 192.168.123.0/24 -j MASQUERADE
:PREROUTING ACCEPT [0:0]
-A PREROUTING -i virbr0 -p tcp -d 192.168.122.1 --dport 445 -j REDIRECT --to-port 1445
-A PREROUTING -i virbr1 -p tcp -d 192.168.123.1 --dport 445 -j REDIRECT --to-port 1445

COMMIT

The iptables config file is:

# Load additional iptables modules (nat helpers)
#   Default: -none-
# Space separated list of nat helpers (e.g. 'ip_nat_ftp ip_nat_irc'), which
# are loaded after the firewall rules are applied. Options for the helpers are
# stored in /etc/modprobe.conf.
IPTABLES_MODULES="ip_conntrack_ftp"

# Unload modules on restart and stop
#   Value: yes|no,  default: yes
# This option has to be 'yes' to get to a sane state for a firewall
# restart or stop. Only set to 'no' if there are problems unloading netfilter
# modules.
IPTABLES_MODULES_UNLOAD="yes"

# Save current firewall rules on stop.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped
# (e.g. on system shutdown).
IPTABLES_SAVE_ON_STOP="no"

# Save current firewall rules on restart.
#   Value: yes|no,  default: no
# Saves all firewall rules to /etc/sysconfig/iptables if firewall gets
# restarted.
IPTABLES_SAVE_ON_RESTART="no"

# Save (and restore) rule and chain counter.
#   Value: yes|no,  default: no
# Save counters for rules and chains to /etc/sysconfig/iptables if
# 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or
# SAVE_ON_RESTART is enabled.
IPTABLES_SAVE_COUNTER="no"

# Numeric status output
#   Value: yes|no,  default: yes
# Print IP addresses and port numbers in numeric format in the status output.
IPTABLES_STATUS_NUMERIC="yes"

# Verbose status output
#   Value: yes|no,  default: yes
# Print info about the number of packets and bytes plus the "input-" and
# "outputdevice" in the status output.
IPTABLES_STATUS_VERBOSE="no"

# Status output with numbered lines
#   Value: yes|no,  default: yes
# Print a counter/number for every rule in the status output.
IPTABLES_STATUS_LINENUMBERS="yes"

FILE=`mktemp -q /tmp/iptables-rules.XXXXXXXXXX`
/opt/ibm/c4eb/firewall/create-rule-file.sh > $FILE
cp $FILE /etc/sysconfig/iptables
rm $FILE

—-Progress update—–
When i run my commands:
sudo iptables -A INPUT -p tcp --dport 2222 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
and also
sudo iptables -A OUTPUT -p tcp --dport 2222 -m conntrack --ctstate ESTABLISHED -j ACCEPT

I see the size of /etc/sysconfig/iptables file increase to 6583. I then do sudo service iptables save. Save is the same. Then I do sudo service iptables restart, and the file reverts to its original size (6219) without my updates! Why!

Am I missing something? Can you see anything I have missed?

Thanks for all support