Opening and Closing Ports in CentOS 6 and 7 using IPtables

Setting up a good firewall is an essential step in securing a system. iptables is the default firewall interface on CentOS 6, while CentOS 7 normally uses firewalld. The examples below open or close TCP port 9042; substitute the port and protocol your application actually needs.

Lifecycle warning: CentOS 6 reached end of life on November 30, 2020 and no longer receives security updates. CentOS 7 reached end of life on June 30, 2024. Keep these commands for legacy maintenance, but isolate old hosts, restrict access to trusted networks, and plan a migration rather than exposing them directly to the internet.

Understand iptables chains and rule order

iptables uses policy chains to allow or block traffic. When a packet arrives, iptables checks rules in a chain from top to bottom and uses the first matching rule. If nothing matches, the chain's default policy applies.

The three standard chains are:

• INPUT controls packets destined for the local machine, such as an incoming SSH connection.
• OUTPUT controls packets created by the local machine, such as outbound DNS or ping requests.
• FORWARD controls packets routed through the machine to another destination.

Two-way protocols also need return traffic. That does not always require a separate outbound rule: an accepting OUTPUT policy or an ESTABLISHED,RELATED rule may already permit it.

List the active IPv4 rules with packet and byte counters:

iptables -L -n -v 

For the INPUT chain, include rule numbers:

iptables -L INPUT -n -v --line-numbers 

The -n option avoids potentially slow DNS lookups. Rule numbers matter because inserting an ACCEPT above a REJECT opens traffic, while placing it below that REJECT has no effect. After deleting a numbered rule, list the chain again because the later rules move up.

Change SSH rules safely

A remote firewall mistake can immediately disconnect you and prevent a new login. Keep your current SSH session open, make the smallest possible change, and test a second connection before saving or restarting anything.

This example temporarily allows SSH from one administrator address. Replace 192.0.2.10 with your own public IP and change 22 if SSH uses another port:

iptables-save > /root/iptables.before-change iptables -I INPUT 1 -p tcp -s 192.0.2.10 --dport 22 -j ACCEPT 

The explicit position 1 puts the test rule before existing denies. Test from a new terminal without closing the working session. When the temporary rule is no longer needed, remove that exact rule rather than flushing the firewall:

iptables -D INPUT -p tcp -s 192.0.2.10 --dport 22 -j ACCEPT 

Do not use iptables -F as a general troubleshooting step. It removes every rule in the chain, and a default DROP policy can still leave you locked out. Prefer a known-good backup, an out-of-band console, and source-restricted rules for administration.

Open a port in CentOS 6

The original iptables approach inserts an ACCEPT rule at the top of INPUT and saves the configuration:

iptables -I INPUT -p tcp -m tcp --dport 9042 -j ACCEPT service iptables save 

Opening a port to every source is often unnecessary. If only one application server needs access, add -s 192.0.2.20/32 after -p tcp, replacing the example address with the real client. Re-run iptables -L INPUT -n -v --line-numbers to confirm the rule appears before any broad REJECT or DROP.

Close a port in CentOS 6

To block the port explicitly, insert a REJECT rule and save it:

iptables -I INPUT -p tcp -m tcp --dport 9042 -j REJECT service iptables save 

Because -I defaults to position 1, this REJECT takes precedence over an older ACCEPT. It can therefore leave redundant rules behind. For a clean ruleset, locate and remove the obsolete ACCEPT by its current line number:

iptables -L INPUT -n -v --line-numbers iptables -D INPUT 4 service iptables save 

Replace 4 with the number shown on your system. Removing an ACCEPT only closes a port if a later rule or the default policy denies that traffic; verify the effective result instead of assuming it does.

service iptables save writes the running rules to /etc/sysconfig/iptables. Without saving, a service restart or reboot can restore the previous configuration. Ensure the service is enabled at boot with chkconfig iptables on, and keep a timestamped iptables-save backup before substantial changes.

Open and close ports in CentOS 7 with firewalld

firewalld is the normal firewall front end on CentOS 7. Avoid managing the same host with both firewalld and a separately enabled iptables service, because their changes can overwrite or conflict with one another.

Runtime versus permanent rules

A firewall-cmd change without --permanent modifies the running configuration and usually takes effect immediately, but it disappears on a reload, service restart, or reboot. A change with --permanent is stored for future use but does not affect current traffic until you reload or apply the same change separately at runtime.

A reload discards runtime-only changes, so inspect existing temporary rules before using one. firewall-cmd --runtime-to-permanent copies the entire active runtime configuration into permanent storage, not just your most recent command.

Opening a port

Check which zone your interface uses, then add and activate the permanent rule:

firewall-cmd --get-active-zones firewall-cmd --zone=public --add-port=9042/tcp --permanent firewall-cmd --reload firewall-cmd --zone=public --list-ports 

Use the active zone shown for your interface rather than assuming it is public.

Closing a port

The original runtime-first method removes the port and saves the running configuration:

firewall-cmd --zone=public --remove-port=9042/tcp firewall-cmd --runtime-to-permanent firewall-cmd --reload 

Be careful: this also makes every other runtime-only change permanent. For a targeted permanent removal, use this instead:

firewall-cmd --zone=public --remove-port=9042/tcp --permanent firewall-cmd --reload 

Troubleshooting and common mistakes

First confirm that the application is listening on the expected interface and port:

ss -lntp 

A firewall rule cannot start a stopped service or fix an application bound only to loopback. On CentOS 7, inspect the complete zone with firewall-cmd --zone=public --list-all; adding a rule to the wrong zone is a frequent cause of apparently ineffective changes. On CentOS 6, use the packet counters from iptables -L INPUT -n -v to see whether traffic reaches the intended rule.

Also check upstream cloud security groups, network firewalls, and TCP Wrappers or application-level access controls. The iptables examples here affect IPv4 only; configure ip6tables separately where IPv6 is present. Finally, do not open a replacement rule before restricting its source when a service contains sensitive data. The smallest useful port, protocol, zone, and source scope is usually the safest choice.