Trying to open port 443 on Debian Linux. What am I doing wrong?

Question

iptables -A INPUT -p tcp --dport 443 -j ACCEPT

followed by a

netstat -tln

shows

tcp        0      0 0.0.0.0:2822            0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:587             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:110             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:143             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:10000           0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:21              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:2812            0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:995             0.0.0.0:*               LISTEN     
tcp6       0      0 :::2822                 :::*                    LISTEN     
tcp6       0      0 :::587                  :::*                    LISTEN     
tcp6       0      0 :::110                  :::*                    LISTEN     
tcp6       0      0 :::143                  :::*                    LISTEN     
tcp6       0      0 :::80                   :::*                    LISTEN     
tcp6       0      0 :::25                   :::*                    LISTEN     
tcp6       0      0 :::993                  :::*                    LISTEN     
tcp6       0      0 :::995                  :::*                    LISTEN  

(Nothing about 443.) It's Debian wheezy.

What am I doing wrong? Syntax?

Solution

Your command likely went through just fine. The second output is expected behaviour: Pretty much nothing you can configure via iptables directly affects what netstat will display.

• netstat -tlpn shows you services ready to accept connections (you have none for port 443 running). Add the -p and it will also tell you the name of the program, which makes it much more helpful.
• iptables -vnL lists rules by which packets will be processed/blocked before reaching any such server. This is the list that tells you "which ports are opened".

What you want to do for further testing is actually start the server you wish to make available. A web server, i assume. If that server has not started, you want to examine its logs. Its likely a webserver will not occupy port 443 if certificate configuration is broken.

Comments

[Troy Osborne]

You could also do: sudo iptables -I INPUT 1 -p tcp --dport 443 -j ACCEPT to put the rule at the top of the list. Jenkins Wiki