Recommended Free Tools
When iptables appears to ignore a rule on a CentOS VPS, the first question is not which rule to type. It is which firewall manager currently owns the policy. firewalld and the legacy iptables-services stack maintain rules differently; editing one while the other is active can leave you inspecting the wrong configuration or have your change disappear at reload or reboot.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Work from the network path inward: reproduce the symptom locally and from another machine, identify the active manager, inspect the live rules with counters and line numbers, verify the service is listening, check IPv4 and IPv6 separately, review logs and any provider firewall, then persist the fix through the manager that owns the policy. Keep an existing SSH session open while changing a remote firewall and verify every change before closing it.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
Start by classifying the failure
Different connection symptoms point to different layers. Test from the VPS itself and from an external client; do not infer a firewall problem from a remote test alone.
| Observed result | What it usually tells you to check first |
|---|---|
| Connection refused | The host is reachable, but no process is accepting the connection on that address and port, or a local rule is actively rejecting it. Check the listening socket and service state. |
| Connection timeout | Traffic may be dropped by the VPS firewall, an upstream provider firewall/security group, a wrong interface or zone, or a route/IPv6 exposure problem. |
| Port appears closed remotely but works locally | The application is running, but the path from the external client is blocked or the service is bound only to loopback or a private address. |
| IPv4 works and IPv6 fails | IPv6 has a separate ruleset and may also have separate provider exposure. An IPv4 allow rule does not authorize IPv6 traffic. |
| Access works until reboot or reload | The running rules were changed without updating the owning manager’s persistent configuration, or a different service restored its own rules. |
Also check whether the VPS platform supplies a security group or network firewall. A packet can be stopped before it reaches the guest, so a correct guest rule cannot compensate for an upstream deny.
#1 Best Overall
- Used Book in Good Condition
Identify the firewall manager before editing anything
CentOS installations commonly use one of two ownership models:
- firewalld: a zone-based manager with separate runtime and permanent configuration. It normally does not use
/etc/sysconfig/iptables. - iptables-services: a service that restores flat IPv4 and IPv6 rule files, normally
/etc/sysconfig/iptablesand/etc/sysconfig/ip6tables.
Run these checks as root or with appropriate privilege:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →systemctl is-active firewalld
firewall-cmd --state
systemctl is-active iptables
systemctl status firewalld
systemctl status iptables ip6tablesAn inactive iptables service does not prove that no filtering exists: firewalld can be enforcing policy through its own backend. Conversely, an empty or missing /etc/sysconfig/iptables is not evidence that firewalld has no rules. Confirm the active manager and inspect its effective runtime state before changing files.
If firewalld is active
Map interfaces to zones
firewalld applies policy through zones assigned to interfaces. Display the active assignments and the zone for a particular interface:
firewall-cmd --get-active-zones
firewall-cmd --get-zone-of-interface=<interface>Use the interface that actually carries the VPS traffic. Looking at a different zone can make a valid rule appear to be missing. List the active zone’s services, ports and other settings, then compare them with its permanent configuration. Runtime changes affect the currently running firewall; permanent settings are what firewalld will load later.
Rank #2
firewall-cmd --list-all
firewall-cmd --permanent --list-allIf the two views differ, decide which state is intentional before reloading. A reload can discard an uncommitted runtime change, while a permanent-only change will not affect current traffic until firewalld reloads.
Change and verify through firewalld
Use firewalld commands and its permanent configuration model rather than inserting raw iptables rules while the daemon is running. The firewalld project explicitly warns: “It is not recommended to use iptables directly while firewalld is running as this could lead into some unexpected issues.” A direct rule may be flushed, reordered or conflict with the zone policy.
After making an intentional permanent change, reload firewalld and immediately inspect the active zone again. Test the service locally and externally, and retain your existing SSH connection until the remote test succeeds. If a change fixes the current session but vanishes after reload, it was only runtime state or was made in a zone that does not own the traffic.
Switching deliberately to iptables-services
Do not run both management approaches casually. If you have a documented reason to move from firewalld to iptables-services, stop and disable firewalld and mask it so another dependency or D-Bus request cannot start it again. Masking is stronger than merely disabling. Plan the transition from a console or with an out-of-band recovery path if the VPS offers one; an incorrect order can cut off SSH.
If iptables-services owns the policy
Inspect live IPv4 and IPv6 rules
Saved files are only one part of the diagnosis. Inspect the rules currently loaded into the kernel, including packet and byte counters and rule order:
Rank #3
iptables -L -n -v --line-numbers
ip6tables -L -n -v --line-numbers
iptables -t nat -L -n -v --line-numbers
ip6tables-save
iptables-saveRed Hat describes verbose output as showing the number of packets and bytes processed by each chain and rule. Those counters are evidence about what is actually matching. A rule with zero packets may be correct but unused, or traffic may be arriving on another interface, protocol or address family. A broad rule above it may already ACCEPT or DROP the packet.
Save a rollback copy before editing:
iptables-save > /root/iptables.backup
ip6tables-save > /root/ip6tables.backupInclude the chain’s line numbers when reasoning about order. The first matching terminal decision generally wins, so an allow rule placed below an earlier DROP or REJECT cannot take effect. Conversely, an earlier broad ACCEPT can make a later restrictive rule appear broken. Compare the filter and NAT tables when forwarding, port translation or container networking is involved.
Check rule semantics one field at a time
For the rule you expect to match, verify all of the following:
- Chain: inbound host traffic normally enters
INPUT; locally generated traffic usesOUTPUT; routed traffic usesFORWARD. - Protocol and destination port: TCP and UDP are different matches, and a service can expose more than one port.
- Address family: an IPv4 address never matches an IPv6 packet, and vice versa.
- Source address: a rule limited to an old client address will not match a changed network.
- Interface: a rule tied to the wrong device or direction will remain at zero counters.
- Connection state: stateful rules must allow the traffic’s actual new or established state.
- Order and policy: inspect preceding ACCEPT, DROP and REJECT entries and the chain’s default policy.
Watch the counters while repeating a controlled connection attempt. If no counter moves, the packet is not reaching that rule; investigate the interface, address family, upstream firewall, routing or service binding rather than adding more copies of the same rule.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Prove the application is listening
A firewall cannot open a port for a process that is not listening. On the VPS, run:
Rank #4
ss -lntupConfirm the expected protocol, port and bind address. A listener on 127.0.0.1 accepts local requests but not connections arriving on the public interface. Test locally with curl for HTTP or an application-specific probe for another protocol, then repeat from an external client. If local access fails, fix the service, its bind address or its own access controls before changing iptables.
Read service, kernel and boot logs
Use the journal to distinguish syntax errors, failed starts, lock contention and kernel-level filtering messages:
journalctl -u firewalld -b
journalctl -u iptables -b
journalctl -k -b
journalctl -p err -bThe -b option limits results to the current boot, making it easier to correlate a reboot-related failure. Filter further by time, priority or service when a rule worked earlier and stopped after a change. Check both iptables and ip6tables service status; one family can fail while the other continues to load.
Make rules survive reloads and reboots
iptables-services persistence
With iptables-services, the IPv4 service reads /etc/sysconfig/iptables and the IPv6 service reads /etc/sysconfig/ip6tables. A rule inserted into the running kernel is not persistent until the saved configuration is updated. After verifying the live behavior, save the intended rules with the service’s save operation or by writing a deliberate iptables-save output, then ensure the services are enabled to load at boot:
service iptables save
systemctl enable iptables ip6tablesUse the service’s own files as the source of truth only after confirming they match the live rules. A stale file can restore an old policy at reboot. Reboot testing should be scheduled with console or recovery access available, and the first post-boot checks should repeat systemctl status, the verbose listings and an external connection test.
Best Value
firewalld persistence
firewalld stores its configuration separately from iptables-services, using XML under /usr/lib/firewalld/ for built-in definitions and /etc/firewalld/ for administrator configuration. Use firewalld commands to make permanent changes, reload, and compare the resulting active zones. Editing iptables-services files will not make a firewalld policy persistent.
Treat IPv6 as an independent firewall
Always test both stacks. Run the corresponding ip6tables listings and saves, verify that the service listens on an IPv6 address, and check whether the VPS provider exposes an IPv6 route or applies a separate network firewall. A successful IPv4 test proves nothing about IPv6. Likewise, allowing a TCP port in iptables does not authorize the same port in ip6tables.
Investigate lock and package failures
If a firewall service fails during startup with a lock-related message, inspect the package versions and the boot journal rather than repeatedly restarting it. Red Hat documented a RHEL 7 race between the iptables and ip6tables startup paths; an update added the --wait option to restore commands to reduce that contention. This is a version-specific issue, so confirm the installed CentOS/RHEL release and updates before applying advice written for RHEL 7.
Choose the right ownership model
| Aspect | firewalld | iptables-services |
|---|---|---|
| Policy model | Zones with runtime and permanent configuration | Flat saved rule files restored by services |
| Primary persistent locations | XML under /usr/lib/firewalld/ and /etc/firewalld/ |
/etc/sysconfig/iptables and /etc/sysconfig/ip6tables |
| Applying changes | Runtime changes can be applied without replacing the complete ruleset; permanent settings require the firewalld persistence model and reload | The service flushes and reloads rules from its saved files |
| IPv4 and IPv6 | Managed through the firewalld policy while still requiring address-family testing | Separate iptables and ip6tables services and files |
| Common remote-change risk | Editing raw iptables rules can conflict with firewalld and be lost or reordered | Changing live rules without saving causes a later restore to remove them |
The safer choice is not the one with the shortest command. It is the manager already integrated with the host, provider image and boot process. Change ownership only as a planned migration.
Handle many blocked addresses efficiently
If a fleet policy must block many addresses, repeatedly rewriting a complete rule set is difficult to audit. CentOS infrastructure documentation demonstrates ipset-backed block lists for this purpose. An ipset lets the policy reference a managed collection while the membership changes independently. Apply this only within the manager that owns the host policy, and verify that the set is restored at boot along with the rules that reference it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsCentOS release differences matter
RHEL 7 and CentOS 7 documentation describes the iptables-services file locations and firewalld’s XML layout above. CentOS Stream and newer RHEL releases may use nftables backends and compatibility commands differently. Do not copy a CentOS 7 procedure blindly: record the distribution release, installed firewall packages, active services and backend before changing a production VPS. The command names may look familiar while the component that ultimately enforces the policy has changed.
A safe end-to-end checklist
- Keep an existing SSH session open and arrange console or recovery access if the provider supplies it.
- Reproduce the failure locally and externally; record whether the result is refused, timed out or successful.
- Check
ss -lntupand a local application probe to prove the service is listening on the expected address and port. - Check the provider’s security group or network firewall for an upstream deny.
- Run
systemctl is-active firewalld,firewall-cmd --stateandsystemctl is-active iptablesto identify ownership. - For firewalld, inspect active zones, interface assignment and runtime versus permanent settings. For iptables-services, inspect IPv4, IPv6 and NAT tables with counters and line numbers.
- Back up the live rules with
iptables-saveandip6tables-savebefore edits. - Check protocol, port, source, interface, chain, state and rule order; watch counters during a controlled test.
- Read the relevant boot, service and kernel journal entries, especially after a restart or package update.
- Persist the change through the owning manager, reload or reboot in a controlled window, and repeat the external IPv4 and IPv6 tests.
This sequence separates an application that is not listening, a guest firewall rule that cannot match, a rule owned by a different manager, an IPv6-only omission and an upstream provider block. That separation is what prevents repeated rule edits from making a remote CentOS VPS less predictable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
