Can not connect with a simple http server(tcp connection) on oracle compute instance(oci), ssh connection works well

Question

I am using oracle cloud to create a http server for learning , so I am new on this. Thank you for your any help!

Instance information

Image: Canonical-Ubuntu-20.04-2022.02.15-0
Shape: VM.Standard.E2.1.Micro

Have added ingress rule on subnet(7500 port): Picture of subnet

Source      IP Protocol Source Port Range Destination Port Range  Allows 
0.0.0.0/0   TCP         All                7500                   TCP traffic for ports: 7500

Using python to create a http server:

python3 -m http.server 7500 &

It was showing：

ubuntu@tcp-server:~$ Serving HTTP on 0.0.0.0 port 7500 (http://0.0.0.0:7500/) ...

Calling lsof -i returns

COMMAND    PID            USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
python3   1806            root    3u  IPv4  33281      0t0  TCP *:7500 (LISTEN)

Allowed 7500 port on ufw:

ufw Status: active

To                          Action        From
                  
7500                       ALLOW       Anywhere                  
7500 (v6)                  ALLOW       Anywhere (v6)

But I can not visit public_Ip_address:7500.

Using telnet:

sudo telnet 152.69.123.118 7500

Returns:

Trying 152.69.123.118...

and does not connect

Thank you in advance!

iso53 · Accepted Answer · 2025-11-16 18:48:06Z

3

The reason is from iptables setting:

sudo nano /etc/iptables/rules.v4

add this sentence:

-A INPUT -p tcp -m state --state NEW -m tcp --dport 7500 -j ACCEPT

then:

sudo su
iptables-restore < /etc/iptables/rules.v4

Done!

Ubuntu image from OCI has been modified by Oracle, the default setting has limitted ports accepted. Therefore we have to open the port manually.

edited Nov 16 at 18:48

iso53

1082 silver badges15 bronze badges

answered Mar 25, 2022 at 7:12

Hakunann

314 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Ryan Jul 2 at 7:54

As stated, this the relevant solution for Ubuntu

Said Torres · Accepted Answer · 2023-04-28 17:19:39Z

2

I had the same problem, the problem was the oracles linux's firewall, you can solve the issue running this command:

firewall-cmd --add-service=http --permanent

answered Apr 28, 2023 at 17:19

Said Torres

6746 silver badges21 bronze badges

Comments

user1409784 · Accepted Answer · 2022-07-29 22:43:02Z

There are some important attributes you need to be aware of when using a fresh ubuntu image on oci. For the sake of this discussion firewall and iptables are synonymous By default

there are 4 chains standard INPUT, FORWARD, OUTPUT and InstanceServices
OUTPUT will have 1 rule

InstanceServices  all  --  *      *       0.0.0.0/0            169.254.0.0/16

InstanceServices destination 169.254.XXX.YYY point to oci services like bootvolume ect ...

FORWARD rejects all
Your default INPUT chain will look like

1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
4    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp spt:123
5    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
6    REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

this allows ssh and udp port 123 for NTP only

create a rule for port 7500 and place it with the existing tcp rule for ssh

sudo iptables -I  INPUT 6  -p tcp -m tcp --dport 7500 -j ACCEPT

now INPUT chain is

1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
4    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp spt:123
5    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:7500
7    REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

as long as we have the correct VCN route table entries, Security list entries or network security group entries for tcp 7500 you can get thru the instance firewall to destination port 7500

Notes
Its really import not to delete the InstanceServices rule in the OUTPUT chain AND not to delete the InstanceServices chain
This can happen if you are new to iptables and you do something like

iptables -F
iptables -X

Its worth it to learn iptables however firewalld is easier.
Oci does not recommend ufw

Your iptable rules will not survive a reboot unless you persist them

these issues are well documented here under subheading Essential Firewall Rules

Collectives™ on Stack Overflow

Can not connect with a simple http server(tcp connection) on oracle compute instance(oci), ssh connection works well

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related