{"id":6820,"date":"2014-04-23T08:09:41","date_gmt":"2014-04-23T08:09:41","guid":{"rendered":"https:\/\/unknownerror.org\/index.php\/2014\/04\/23\/iptables-messing-up-tomcat-collection-of-common-programming-errors\/"},"modified":"2014-04-23T08:09:41","modified_gmt":"2014-04-23T08:09:41","slug":"iptables-messing-up-tomcat-collection-of-common-programming-errors","status":"publish","type":"post","link":"https:\/\/unknownerror.org\/index.php\/2014\/04\/23\/iptables-messing-up-tomcat-collection-of-common-programming-errors\/","title":{"rendered":"iptables messing up Tomcat?-Collection of common programming errors"},"content":{"rendered":"

I encountered the following problem(s) using Tomcat 7 with iptables on.<\/p>\n

1) Namely, there’s this Tomcat 7 instance that I run on server-1<\/strong> (directly exposed), and this Tomcat instance hosts a REST web-service. Tomcat itself is configured with SSL (NIO, not APR\/native), with clientAuth=\"true\"<\/code>. Keystores, certs, and everything seems to be set up OK and working.<\/p>\n

On this server, iptables are up and running allowing all traffic from server-2<\/strong>, and the last rule in the filter INPUT chain is:<\/p>\n

\n

-A INPUT -j REJECT –reject-with icmp-host-prohibited<\/p>\n<\/blockquote>\n

Now, from server-2<\/strong>, I try to call the web-service and I fail with connection \/ read timeout exceptions.<\/p>\n

2) Tomcat won’t shut down – I get “No route to host” exception message when trying to shut it down via its shutdown script.<\/p>\n

As soon as the last rule specified above in iptables on server-1<\/strong> is removed, both problems go away… Both servers are running CentOS 6 64.<\/p>\n

Can someone shed some light on this?<\/p>\n

EDIT<\/strong>
\nHere are all the other current INPUT rules:<\/p>\n

\n

\/\/ VPN Related -A INPUT -s xx.xx.xx.xx -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp –dport 1723 -j ACCEPT -A INPUT -i eth0 -p gre -j ACCEPT -A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i eth0 -p udp -m udp –dport 1701 -j ACCEPT -A INPUT -i eth0 -p udp -m udp –dport 4500 -j ACCEPT -A INPUT -i eth0 -p udp -m udp –dport 443 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp –dport 443 -j ACCEPT -A INPUT -i eth0 -p udp -m udp –dport 500 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp –dport 1701 -j ACCEPT \/\/ FreeRadius -A INPUT -i eth0 -p tcp -m tcp –dport 1812 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp –dport 1813 -j ACCEPT -A INPUT -i eth0 -p udp -m udp –dport 1812 -j ACCEPT -A INPUT -i eth0 -p udp -m udp –dport 1813 -j ACCEPT \/\/ Tomcat -A INPUT -i eth0 -p tcp -m tcp –dport 4445 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp –dport 8345 -j ACCEPT -A INPUT -i eth0 -p tcp -m tcp –dport 8007 -j ACCEPT -A INPUT -i eth0 -p udp -m udp –dport 4445 -j ACCEPT -A INPUT -i eth0 -p udp -m udp –dport 8345 -j ACCEPT \/\/ Allow all from server-2 -A INPUT -i eth0 -s xx.xx.xx.xx -j ACCEPT \/\/ System -A INPUT -i eth0 -p tcp -m tcp –dport 22 -j ACCEPT \/\/ Reject<\/p>\n

-A INPUT -j REJECT –reject-with icmp-host-prohibited<\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"

I encountered the following problem(s) using Tomcat 7 with iptables on. 1) Namely, there’s this Tomcat 7 instance that I run on server-1 (directly exposed), and this Tomcat instance hosts a REST web-service. Tomcat itself is configured with SSL (NIO, not APR\/native), with clientAuth=”true”. Keystores, certs, and everything seems to be set up OK and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-6820","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/posts\/6820","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/comments?post=6820"}],"version-history":[{"count":0,"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/posts\/6820\/revisions"}],"wp:attachment":[{"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/media?parent=6820"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/categories?post=6820"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unknownerror.org\/index.php\/wp-json\/wp\/v2\/tags?post=6820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}