Diagnose & Resolve Issues with Firewalls

Updated Friday, August 14, 2020 by Linode Written by Linode

This guide presents troubleshooting strategies for Linodes that may be unresponsive due to issues caused by a firewall.

In many cases, you might suspect a firewall issue if only some of your services are inaccessible, or in situations of limited access. A firewall may also be suspected if an issue was noticed not long after implementing new firewall rules.

It’s important to note that while a firewall is often responsible for cases of limited access, these issues may also potentially be caused by a wide array of other issues such as limited network access, resource contention like throttled memory, or internal processes or services that are not configured to communicate over the internet.

Before You Begin

You should familiarize yourself with Lish. It is a helpful troubleshooting tool for diagnosing connection problems.

The Linode Shell (Lish)

Lish is a shell that provides access to your Linode’s serial console. Lish does not establish a network connection to your Linode, so you can use it when your networking is down or SSH is inaccessible. If you find yourself locked out of SSH, you can use Lish to perform much of the troubleshooting for basic connection issues.

To learn about Lish in more detail, and for instructions on how to connect to your Linode via Lish, review the Using the Linode Shell (Lish) guide. In particular, using your web browser is a fast and simple way to access Lish.

Note

The root user is available in Lish even if root user login is disabled in your SSH configuration.

Is my Linode Powered On?

To begin, log into the Cloud Manager and inspect the Linode’s dashboard. If the Linode is powered off, turn it on.

Is my Cloud Firewall Effecting Me?

If you are using Linode’s Cloud Firewall then it’s important to check your rules and observe which Linodes are currently affected by Cloud Firewall.

1. Log into Cloud Manager and select Firewalls from the menu.

2. The Firewalls screen displays a list of all the firewalls currently active on your account.

   

3. To find the Linode that you believe is being affected, look in the Linodes column for the label you’ve assigned it.

4. Next, check the Status column to confirm that the firewall is Enabled.

5. If so, check what rules are currently applied by clicking on the Edit link in the row for the firewall you wish to edit, or by clicking on the label of the firewall itself. Doing either opens the Rules page.

   

6. The Rules page displays a list of all of the firewall rules that are affecting Linodes that the firewall has been applied to. You can also view these individual rules by Type, Protocol, Port Range, and Sources by clicking those words in the header.

7. If these rules seem to be affecting your service or services, you can remove or edit these rules independently by clicking the Edit or Delete links to the right of each rule respectively.

   Note

   Cloud Firewall rules are applied on the host level and are not detectable internally on Linodes. For more on how to setup and use Cloud Firewall, see the guide A Tutorial for Adding and Configuring Linode Cloud Firewalls.

Checking Firewall Rules with UFW

Uncomplicated Firewall or UFW is an iptables frontend that is designed for ease-of-use. To find more information, see our guide on How to Configure a Firewall with UFW.

To see all active UFW rules, enter the following command:

sudo ufw status

Your output will be similar to the following:

  
Status: active

To                         Action      From
--                         ------      ----
22                         ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443                        ALLOW       Anywhere
22 (v6)                    ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)
443 (v6)                   ALLOW       Anywhere (v6)

If the status is active, the rules listed are all in place and may be blocking one of your services. To remove any individual firewall rule, use the following syntax:

sudo ufw delete <Action> <To>

For example, to delete the Allow rule for port 80 from the example output above, enter the following command:

sudo ufw delete allow 80

Checking Firewall Rules with FirewallD

firewalld is the default firewall tool for CentOS and Fedora. While also a frontend for iptables like UFW, firewalld has some behaviours that are unique, like configuration sets and zones.

To list all all configurations for all zones, enter the following command:

sudo firewall-cmd --list-all-zones

If you find a rule that doesn’t belong, you can safely remove it using the following syntax:

sudo firewall-cmd --zone=zonename --remove-service=servicename --permanent

For more information on understanding firewalld, see our guide to firewalld, Introduction to FirewallD on CentOS

Checking Firewall Rules with iptables

iptables is the most common firewall used on Linux systems. If you’re unsure of which firewall software you may be using, chances are that it’s iptables in some form.

To list all active firewall rules using iptables, enter the following commands for IPv4 and IPv6 respectfully:

sudo iptables -L -nv

sudo ip6tables -L -nv

Removing rules uses the same syntax to add rules, with the addition of the -D or --delete option. For example, use the following commands to delete a rule that drops connections to port 110, on the eth0 interface, towards the IPv4 address 198.51.100.0:

iptables --delete INPUT -j DROP -p tcp --destination-port 110 -i eth0 -d 198.51.100.0

or

iptables -D INPUT -j DROP -p tcp --destination-port 110 -i eth0 -d 198.51.100.0

For more information on reading and interpreting iptables rules see our guide on iptables, A Tutorial for Controlling Network Traffic with iptables

Join our Community

Find answers, ask questions, and help others.

This guide is published under a CC BY-ND 4.0 license.