Otdfbt

I am trying to reconfigure httpd my virtual private server but I cannot seem to access it. curl on the server itself works but trying to hit the server using chrome on another pc gives a "this site took too long to respond" error message.

My vps has centos 7 but oddly it has iptables and not firewalld installed.

this is the contents of my /etc/sysconfig/iptables file, do I need to change something to allow http on port 80 and https on 443?

# Generated by iptables-save v1.4.21 on Wed Mar 27 19:30:55 2019
*raw
:PREROUTING ACCEPT [654:52805]
:OUTPUT ACCEPT [577:72088]
COMMIT
# Completed on Wed Mar 27 19:30:55 2019
# Generated by iptables-save v1.4.21 on Wed Mar 27 19:30:55 2019
*mangle
:PREROUTING ACCEPT [654:52805]
:INPUT ACCEPT [654:52805]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [577:72088]
:POSTROUTING ACCEPT [577:72088]
COMMIT
# Completed on Wed Mar 27 19:30:55 2019
# Generated by iptables-save v1.4.21 on Wed Mar 27 19:30:55 2019
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [44:9111]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Mar 27 19:30:55 2019
# Generated by iptables-save v1.4.21 on Wed Mar 27 19:30:55 2019
*nat
:PREROUTING ACCEPT [392:22692]
:POSTROUTING ACCEPT [14:1008]
:OUTPUT ACCEPT [14:1008]
COMMIT
# Completed on Wed Mar 27 19:30:55 2019

Looks like your "allow" rule is after the "reject" rule. This part:

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

You need to move that allow rule one line up.

To troubleshoot, you can do the following:

sudo watch -n1 -d iptables -t filter -L INPUT -nvx --line-numbers

You'll see something like this:

Every 1.0s: iptables -t filter -L INPUT -nvx localhost: Mon Apr 1 14:08:04 2019

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 12 956 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
3 3 281 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
4 1 90 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
5 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443 ctstate NEW,ESTABLISHED

Now watch the number of packets going through each rule, and see which one grows when you run your test. This may be your hint.

To fix this, you can do an online rule change. E.g., add that last rule as rule number 4, and then remove the last rule.

With the above output, you want to insert the "allow rule" as rule number 4.

$ sudo iptables -I INPUT 4 -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

Now check the rules again

$ sudo iptables -L INPUT -n --line-numbers

Chain INPUT (policy ACCEPT)
num target prot opt source destination 
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 
3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 
4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443 ctstate NEW,ESTABLISHED
5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
6 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443 ctstate NEW,ESTABLISHED

And now delete the last rule, which is obsolete.

$ sudo iptables -D INPUT 6

Double check your output again.

$ sudo iptables -t filter -L INPUT --line-numbers

Chain INPUT (policy ACCEPT)
num target prot opt source destination 
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 
3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 
4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443 ctstate NEW,ESTABLISHED
5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

In all fairness, I don't see rules defaulting to "REJECT" often. A more common one is "DROP", and you can set that as a default policy. E..g,

$ sudo iptables -t filter -P INPUT DROP

Then you can remove the "reject" rule altogether

$ sudo iptables -t filter -D INPUT -j REJECT --reject-with icmp-host-prohibited
$ sudo iptables -L INPUT -n
Chain INPUT (policy DROP)
target prot opt source destination 
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443 ctstate NEW,ESTABLISHED

Now sure what your OS is, but you can probably sudo service iptables save to save your runtime changes to /etc/sysconfig/iptables.