Troubleshoot iptables Problems on a CentOS VPS

This guide helps you diagnose and fix common iptables issues on a CentOS VPS, from rules that won’t save to accidentally locking yourself out. You’ll learn systematic checks and practical fixes to restore your firewall quickly.

What You’ll Need

• Root or sudo access to your CentOS VPS (via SSH or the hosting provider’s console).
• Basic familiarity with the command line.
• If you’ve lost SSH access, use your provider’s out-of-band console (e.g., VNC or web terminal) to recover.

Step-by-Step

1. Check if iptables is actually running. Run systemctl status iptables (or service iptables status on older CentOS 6). If it’s inactive or failed, start it with systemctl start iptables and enable it with systemctl enable iptables.
2. List current rules. Use iptables -L -n -v to see all rules with line numbers and packet counts. Add --line-numbers for easier editing. If the output is empty or unexpected, you may have flushed rules or loaded the wrong table.
3. Check specific tables. iptables has multiple tables: filter (default), nat, mangle, and raw. View them with iptables -t nat -L -n -v, iptables -t mangle -L -n -v, etc. Many issues are caused by rules in the nat table (e.g., for port forwarding) that are missing or misordered.
4. Verify the default policy. Look at the INPUT, FORWARD, and OUTPUT chain policies. If INPUT policy is DROP and you have no allow rule for SSH (port 22), you’ll be locked out. The policy is shown at the top of each chain.
5. Test connectivity after each change. After modifying rules, test from another machine: ping for ICMP, ssh for port 22, or use nc -vz your_server_ip 80 for HTTP. If you lose SSH, use the console to revert.
6. Check rule order. iptables processes rules top-down; the first match wins. If you have a broad DROP rule before a specific ACCEPT, the ACCEPT never runs. Insert specific rules with -I (insert at top) instead of -A (append to bottom).
7. Look for typos and syntax errors. A common mistake is using --dport without -p tcp or -p udp. For example, iptables -A INPUT -p tcp --dport 22 -j ACCEPT is correct; omitting -p tcp will cause an error.
8. Check if rules are being saved. On CentOS 6, use service iptables save to persist. On CentOS 7+, you must install iptables-services and then use service iptables save. If you’re using firewalld, it may override iptables; disable it with systemctl stop firewalld and systemctl disable firewalld.
9. Inspect logs. iptables can log dropped packets if you have a LOG rule. Add one temporarily: iptables -I INPUT -j LOG --log-prefix "IPT_DROP: " and then check journalctl -k or tail -f /var/log/messages. Remove the rule after testing.
10. Test with a simple rule set. If nothing works, flush all rules (iptables -F) and set a permissive policy (iptables -P INPUT ACCEPT) to confirm the problem is with your rules, not the kernel or network.

Common Mistakes

• Forgetting to enable IP forwarding for NAT or port forwarding. Run sysctl net.ipv4.ip_forward=1 and make it permanent in /etc/sysctl.conf.
• Using the wrong interface name. On VPS, interfaces are often eth0, but could be ens3 or venet0. Check with ip a.
• Blocking loopback. Always allow loopback: iptables -A INPUT -i lo -j ACCEPT. Blocking it can break local services.
• Not saving rules after testing. You may fix the issue but lose it on reboot. Always save after a successful change.
• Conflicting with firewalld. CentOS 7+ uses firewalld by default. If you’re mixing both, they can interfere. Stick to one.

Tips

• Use a script to manage rules. Write your rules in a shell script and run it. This makes it easy to revert and version control.
• Add a cron job to save rules regularly. For example, @reboot /usr/sbin/iptables-restore < /etc/sysconfig/iptables.
• Test with a temporary rule that auto-reverts. Use at now + 5 minutes to schedule a flush in case you lose connectivity.
• Use iptables-save and iptables-restore. These commands dump and load rules in a format that's easy to edit and backup.
• Keep a backup of your working rules. iptables-save > /root/iptables.backup before making changes.

Troubleshooting

If the above steps don't resolve your issue:

• You're still locked out. Use your hosting provider's console (VNC, KVM, etc.) to log in locally. Then flush rules and start over. If you can't access the console, contact your provider's support.
• Rules are correct but traffic still drops. Check if there are other firewalls (e.g., cloud provider security groups, fail2ban, or cPanel's firewall). Disable them temporarily to isolate.
• Changes don't persist after reboot. Ensure iptables-services is installed and enabled. On CentOS 7+, run systemctl enable iptables and systemctl start iptables. Also check if firewalld is masking it.
• iptables command not found. Install it with yum install iptables-services (CentOS 7) or yum install iptables (older).
• Kernel module issues. In rare cases, modules like ip_tables may not load. Check with lsmod | grep ip_tables. If missing, try modprobe ip_tables.

Frequently Asked Questions

How do I allow SSH after I accidentally blocked it?

Use your VPS console to log in locally, then run iptables -I INPUT -p tcp --dport 22 -j ACCEPT and save. If you can't, contact your provider.

Why do my rules disappear after reboot?

iptables rules are not persistent by default. Install iptables-services (CentOS 7+) and run service iptables save, or use iptables-restore in a startup script.

Can I use both firewalld and iptables?

Technically yes, but they manage the same kernel netfilter, so they can conflict. It's best to disable one. If you prefer iptables, stop and disable firewalld.

How do I open a port for a specific IP only?

Use -s to specify source IP: iptables -A INPUT -p tcp --dport 22 -s 192.168.1.100 -j ACCEPT. Place this before any deny rules.

What's the difference between -I and -A?

-I inserts a rule at the top (or a specified position) of a chain; -A appends it to the bottom. Since iptables processes rules in order, -I is often used to prioritize a rule.

How do I see packet counts for my rules?

Use iptables -L -n -v. The counters show how many packets and bytes have matched each rule. This helps identify if a rule is being used.

Related

• AI Hyperscalers’ Storytelling Problem Explained
• LangGraph Agents with Shared Persistent Python Memory
• DeepSeek Upload Failed? Causes and Fixes