80

This is an elementary question however one I cannot seem to resolve by perusing the Oracle Cloud Infrastructure documentation. I've created an Ubuntu-based compute node, and it's attached to a subnet. In that subnet I've created a stateful rule with source 0.0.0.0/0, IP protocol: TCP, Source Port Range: All, Destination Port Range: 80.

There is no firewall configured on the server.

Despite this configuration I can't access the compute node's public IP. Any ideas?

7 Answers 7

165

I figured it out. The connectivity issue was due to Oracle's default use of iptables on all Oracle-provided images. Literally the very first thing I did when spinning up this instance was check ufw, presuming there were a few firewall restrictions in place. The ufw status was inactive, so I concluded the firewall was locally wide open. Because to my understanding both ufw and iptables look at the netfilter kernel firewall, and because ufw is the de facto (standard?) firewall solution on Ubuntu, I've no idea why they concluded it made sense to use iptables in this fashion. Maybe just to standardize across all images?

I learned about the rules by running:

sudo iptables -L

Then I saved the rules to a file so I could add the relevant ones back later:

sudo iptables-save > ~/iptables-rules

Then I ran these rules to effectively disable iptables by allowing all traffic through:

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -F

To clear all iptables rules at once, run this command:

iptables --flush

Anyway, hope this helps somebody else out because documentation on the matter is non-existent.

10
  • 5
    Oracle documents the use of iptables instead of ufw and security implications of opening up iptables to all traffic in their best practices documentation: docs.cloud.oracle.com/en-us/iaas/Content/Compute/References/… May 19, 2020 at 20:37
  • 31
    WARNING!!!! If you run $iptables --flush, you will lose all access to the machine, essentially bricking it!!!
    – Him
    Jul 5, 2020 at 23:26
  • 10
    I wish it wouldn't have been so hard for me to find this answer. I don't know why Oracle bothers with adding firewall rules on the server, when everything is protected at the infrastructure level. Thank you!
    – GeekLad
    Oct 23, 2020 at 18:40
  • 3
    Please, consider the oracle tutorial. It mentioned this issue exactly (look for "Update firewall settings"); docs.oracle.com/en-us/iaas/developer-tutorials/tutorials/…
    – disooqi
    Dec 12, 2021 at 22:07
  • 2
    If you do flush your iptables and can't access your instance see docs.oracle.com/en-us/iaas/Content/Compute/References/… and the section on "To boot into maintenance mode" you can use the console connection to fix the iptables settings
    – Joe
    Dec 16, 2021 at 19:19
135

When deploying compute instances at Oracle Cloud Infrastructure you need to take into account few things:

  1. Create Internet Gateway (IGW).
  2. Define routes to point to IGW.
  3. Allow port 80 in the Security List associated with the IGW. By default you only have access to SSH and ICMP 3,4 type.
  4. Allow connectivity on Compute's instance firewall (which is enabled by default).

In your example if you are using a OEL shape:

$ sudo firewall-cmd --zone=public --permanent --add-port=80/tcp

$ sudo firewall-cmd --reload
8
  • 1
    Awesome! In my case, ssh(22) worked great, port 80 was not. As I followed all steps above(including "firewall-cmd" steps), the magic happened!
    – kimchoky
    Sep 28, 2019 at 10:18
  • 38
    This worked for me but only after sudo apt install firewalld Nov 1, 2019 at 21:43
  • 2
    @kimchoky yes I also had the same situation. I can't understand why port 22 would be treated differently. Access via SSH didn't require any setup (except for the keys). But access via HTTP would require more rules. I find it confusing, had no insight, and still can't understand the reason for the difference. Jan 10, 2021 at 17:37
  • 3
    For anyone finding this now and trying to set up an instance, I found by following Oracle's docs on creating the internet gateway (docs.oracle.com/en-us/iaas/Content/Network/Tasks/…) that when I had created my first instance, a lot of this was already created automatically for me. I already had a VCN, a security list with a few ingress rules, notably one that allows SSH (explaining how I was able to SSH into my server before noticing it can't serve HTTP on port 80), and an internet gateway. The subnet in the VCN was already linked to the internet gateway via a route rule.
    – Matt Welke
    Jul 8, 2021 at 3:17
  • 2
    However, before being able to accomplish my goals (test serving HTTP on port 80 by installing NGINX, and then set up and connect to a Java Minecraft server), I had to follow the steps given in the other answer here related to iptables. Additionally, I found that I wasn't able to connect in to the ports I had unblocked every time the instance was stopped and restarted until I ran the iptables --flush command on it after each restart. Because I don't know how iptables works, that's my next thing to learn more about to understand why I had to do this.
    – Matt Welke
    Jul 8, 2021 at 3:20
86

Always refer to the official guide: https://docs.cloud.oracle.com/en-us/iaas/developer-tutorials/tutorials/apache-on-ubuntu/01oci-ubuntu-apache-summary.htm

$ sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport 80 -j ACCEPT
$ sudo netfilter-persistent save
$ sudo systemctl restart apache2
4
  • 4
    For my single Ubuntu 20.04 instance, I configured Ingress Rules for many other [app required port], such as MySQL 3306 and TightVNCServer 5901, but they are not taking effect. After I executed "sudo iptables -I INPUT 6 -m state --state NEW -p tcp --dport [app required port] -j ACCEPT" and "sudo netfilter-persistent save", my instance can be accessed from Internet, magically.
    – oraclesoon
    Sep 16, 2020 at 17:57
  • 1
    You also have to allow through the VCN IP restrictions
    – YaRmgl
    Oct 15, 2021 at 13:00
  • this will work on nginx too, thanks. Jan 6, 2022 at 14:48
  • This actually worked, thanks! I don't see it mentioned in the linked article though... and I would appreciate an explanation about all the iptables options. It's not trivial to understand what -m state --state NEW does from the manpage alone. (edit: it's under Apache ... but I'm not using apache...)
    – lucidbrot
    Feb 13, 2022 at 18:22
31

credited to https://medium.com/@fathi.ria/oracle-database-cloud-open-ports-on-oci-1af24f4eb9f2

Coumputer Instance(Such as Ubuntu) -> Virtual Cloud Network -> Security List -> Ingress Rules -> Please add a rule to allow access to port 80 from anywhere

3
  • 1
    THIS is actually what worked for me (except I figured it out on myself, lol).
    – Paul
    Oct 17, 2021 at 22:33
  • 1
    That workd ;-) A big headache with this. Lost my time with iptables deal with only Dec 25, 2021 at 18:56
  • oh man, a great relief. Thank you a lot man. after 2 days of no sleep. but that doesn't make sense. all ports incoming and outgoing are already accepted. why this needed to do. I'm very much curious and confused as well.
    – Mahmud Oni
    Oct 14, 2022 at 8:01
21

Pre-Requisite

  1. VM instance should have been created and running
  2. Access to Public and Private keys used during the creation of VM instance

Log into the VM using SSH and run the following command

$ sudo iptables --list --line-numbers

It will show the details about Chain INPUT (policy ACCEPT). From the list required to Delete REJECT all rule in the IPTABLES.

$ sudo iptables -D INPUT <Reject Line number>
e.g.
$ sudo iptables -D INPUT 6

Check if the REJECT rule is deleted

sudo iptables --list --line-numbers 

Access the Default Security List and Edit Ingress Rules to Allow Internet Traffic on Port

Edit the INGRES Rule Add CIDR 0.0.0.0/0 TCP Destination 9999 (N): Networking >Virtual Cloud Networks> Virtual Cloud Network Details>Security Lists> Security List Details

Access your application via web browser

Type http://<public IP address of the VM>:port
2
  • 3
    this is the best answer for me, since it effectively removes iptables from the equation and does not mess oracle rules for the block devices. It's enough protection to have the oci gateway and ingress rules. this is just oracle usual "expert level" requirements... Jul 3, 2022 at 17:21
  • 1
    this is most appropriate answer Mar 10 at 9:28
12

I guess if you add the rule below to your iptables it should work; otherwise you'll be disturbing other rules which are related to block volume attachment that comes preconfigured on those Oracle images.

iptables -I INPUT 5 -i ens3 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
4
  • 3
    This command works. To make the changes persistent even after reboot, we need to additionally run: netfilter-persistent save
    – WebDev
    Nov 22, 2019 at 12:36
  • I got: iptables: Index of insertion too big. Jun 9, 2020 at 6:38
  • @user2650501 the index issue is because of specifying the position 5 for the rule, while if you run sudo iptables -L you'll see that your current rules are less than 4 (probably empty). Jan 10, 2021 at 19:05
  • to persist (as root - "sudo su"): iptables-save > /etc/iptables/rules.v4 Mar 31, 2022 at 14:32
0

If you have not created Internet Gateway yet, that might be the reason. In order to connect the VCN with the public internet you need to have an Internet Gateway and a route table to direct the traffic through the gateway.

0

Not the answer you're looking for? Browse other questions tagged or ask your own question.