iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
When iptables appears to be ignored on a CentOS VPS, the usual problem is not the rule syntax. It is that a different firewall manager owns the active policy, a rule earlier in the chain wins, IPv6 is being tested separately, or an upstream provider firewall blocks the traffic first. Establish ownership, test the service locally and remotely, inspect the live rules with counters and line numbers, then persist changes through the manager that actually controls the host.
This guide covers CentOS 7 and the RHEL 7-era iptables-services model, firewalld-managed systems, and the version differences you must consider on CentOS Stream and newer RHEL-derived releases.
Free tools Windows power users keep installed
One-click scans. No signup required.
1. Establish which firewall manager owns the policy
CentOS can use two different management layers. firewalld maintains zones and runtime/permanent configuration, while iptables-services loads flat rule files from /etc/sysconfig/iptables and /etc/sysconfig/ip6tables. They are not interchangeable. Editing an iptables rule directly while firewalld is active can produce a rule that disappears on reload or conflicts with firewalld’s generated rules.
Check firewalld first
systemctl is-active firewalld
systemctl status firewalld
firewall-cmd --stateIf the first command returns active or firewall-cmd --state returns running, firewalld is participating in the policy. The firewalld project explicitly warns that using iptables directly while firewalld is running can cause unexpected issues. Manage the policy with firewall-cmd instead of writing directly to generated chains.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Check iptables-services
systemctl is-active iptables
systemctl status iptables
systemctl is-active ip6tables
systemctl status ip6tablesAn active iptables service indicates that the legacy service may be restoring rules from its saved file. Check ip6tables independently; IPv4 and IPv6 are separate rule families and can have different service states.
Do not infer ownership from an empty file
An empty or missing /etc/sysconfig/iptables does not prove that the VPS has no firewall. Red Hat documents that firewalld normally does not use that file. Always check service state and effective runtime rules.
2. Confirm what “not working” means
Different connection symptoms point to different layers. Test from the VPS itself and from a genuinely external client; a test made on the same host can bypass the network path that is failing.
Check that the application is listening
ss -lntupLook for the expected TCP or UDP port and the bind address. A listener on 127.0.0.1 or ::1 accepts local connections only. To serve the network, the application generally needs to bind to the VPS address or an appropriate wildcard address, subject to the application’s own security settings.
Probe locally
curl -v http://127.0.0.1:PORT/
curl -v http://VPS_PRIVATE_OR_PUBLIC_ADDRESS:PORT/Use an application-specific probe for non-HTTP services. A local success with a remote failure shifts attention to firewall, routing, provider controls, or the bind address. A local failure means the application, socket, or host configuration must be fixed before changing firewall rules.
Interpret the remote symptom
- Connection refused: the destination was reachable but no process accepted the connection, or a firewall actively rejected it.
- Timeout: packets may be dropped by a host rule, provider firewall, route, or network ACL; confirm every layer rather than assuming iptables.
- Successful TCP connection followed by an application error: the firewall permitted the connection; investigate the service protocol or application.
- Works from the VPS but not from outside: verify the listening address, host policy, provider security group, and any upstream network firewall.
Also check whether the VPS platform supplies a security group, cloud firewall, or network ACL. That control is outside the host’s iptables rule set and can block a port even when the local policy is correct.
3. Inspect the active policy, not just saved files
Saved files describe what a service may load later. They do not necessarily describe the rules currently filtering packets. Inspect the live policy first, and save a backup before editing.
Back up iptables-services rules
iptables-save > /root/iptables.backup
ip6tables-save > /root/ip6tables.backupThe backup is a plain-text snapshot that lets you compare changes or restore a known state from a provider console if a remote edit locks you out.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
List IPv4 rules with counters and order
iptables -L -n -v --line-numbers
iptables -t nat -L -n -v --line-numbers
iptables -t mangle -L -n -v --line-numbersThe -v output includes packets and bytes matched by each rule, while --line-numbers exposes evaluation order. A rule with zero counters may not be seeing the traffic at all. A broad ACCEPT or DROP above it can decide the packet first.
List IPv6 rules separately
ip6tables -L -n -v --line-numbers
ip6tables -t nat -L -n -v --line-numbers
ip6tables-saveDo not use an IPv4 listing as evidence about IPv6. A port opened in iptables is not automatically opened in ip6tables, and the provider may expose an IPv6 address even when IPv4 testing succeeds.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Inspect firewalld’s effective zones
firewall-cmd --get-active-zones
firewall-cmd --get-zone-of-interface=INTERFACE
firewall-cmd --list-all
firewall-cmd --permanent --list-allThe first two commands show which zones are active and where an interface is assigned. Compare runtime output with --permanent output; a change made only at runtime can vanish on reload or reboot, while a permanent change is not active until firewalld reloads.
4. Read rule order and match conditions
iptables evaluates chains from top to bottom. A packet normally stops being evaluated when it reaches a terminating verdict such as ACCEPT, DROP, or REJECT. A rule can be perfectly written and still have no effect if another rule matches first.
Verify the complete match
- Chain: inbound service traffic normally enters
INPUT; locally generated traffic usesOUTPUT; routed traffic usesFORWARD. - Protocol: TCP and UDP are separate. A TCP rule does not open a UDP service on the same port.
- Destination port: confirm the application is using the port you opened, and that the rule specifies the intended protocol.
- Source address: a rule restricted to one address or subnet will not match another client.
- Interface: an interface qualifier can exclude traffic arriving through the VPS’s actual public interface.
- Connection state: stateful rules must allow the initial connection and the return traffic, commonly through an established/related rule.
- Address family: IPv4 rules do not match IPv6 packets.
Use counters as a test instrument
Record the packet and byte counters, make one controlled connection attempt, and list the chain again. The rule whose counters increase is the rule that saw the packet. If every expected rule remains at zero, investigate the interface, address family, provider firewall, routing, or whether the service is listening at all.
Inspect all relevant tables
Most access decisions are in the filter table, but NAT or mangle rules can alter the path or destination before filtering. Include -t nat and, where relevant, -t mangle in the inspection. A rule visible only in a saved file is not proof that the kernel has loaded it.
Recommended Free Tools
5. Troubleshoot a firewalld-managed VPS
When firewalld owns the policy, work with its zone and runtime/permanent model rather than inserting ad-hoc iptables rules.
Map the interface to a zone
firewall-cmd --get-active-zones
firewall-cmd --get-zone-of-interface=eth0
firewall-cmd --zone=ZONE --list-allReplace eth0 with the interface shown by ip addr. The service or port must be allowed in the zone receiving the VPS’s traffic. Looking at a different zone can make a correct rule appear to be missing.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Compare runtime and permanent configuration
firewall-cmd --zone=ZONE --list-services
firewall-cmd --zone=ZONE --list-ports
firewall-cmd --permanent --zone=ZONE --list-services
firewall-cmd --permanent --zone=ZONE --list-portsRuntime settings affect packets now. Permanent settings are stored for future reloads. If the two views differ, decide which state is authoritative before changing anything.
Make and activate a persistent change
- Allow a predefined service when one exists, or allow the exact port and protocol required by the application.
- Repeat the command with
--permanentso the policy survives a reload or reboot. - Reload firewalld.
- List the zone again and repeat the local and remote test.
firewall-cmd --zone=ZONE --add-service=SERVICE
firewall-cmd --permanent --zone=ZONE --add-service=SERVICE
firewall-cmd --reload
firewall-cmd --zone=ZONE --list-allUse the equivalent --add-port=PORT/tcp or PORT/udp form when no suitable service definition exists. Keep an existing SSH rule available during remote work, and use an out-of-band console for recovery if the reload removes your access.
Switching deliberately to iptables-services
If you have a documented reason to abandon firewalld, stop and mask it before enabling iptables-services. The firewalld project documents masking because merely disabling the service can allow another dependency or D-Bus request to start it again. Plan this change from a provider console or maintenance window; changing managers over an SSH session can disconnect you.
6. Troubleshoot an iptables-services VPS
With iptables-services, the service restores rules from /etc/sysconfig/iptables and /etc/sysconfig/ip6tables. Runtime edits and saved files can diverge.
Check service state and files
systemctl status iptables
systemctl status ip6tables
ls -l /etc/sysconfig/iptables /etc/sysconfig/ip6tablesOn CentOS 7 and the corresponding RHEL 7 model, these files are the normal persistence locations. Newer CentOS Stream and RHEL releases may use nftables backends or compatibility commands, so confirm the release and installed packages before assuming the legacy service layout.
Save a tested runtime policy
After you have verified the runtime rules, use the service’s save mechanism or redirect iptables-save to the appropriate file. The classic service command is:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11service iptables saveAlternatively, write an intentional snapshot with iptables-save and do the same for IPv6. Then enable the services so they load at boot:
systemctl enable iptables
systemctl enable ip6tablesDo not save an untested policy immediately after a failed experiment. First confirm SSH access, required application ports, and the desired default policies; otherwise the next reboot can restore the mistake.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Test a reload without rebooting
- Keep the backup files created earlier.
- Confirm that the saved files contain the intended rules and no syntax errors.
- Reload or restart the relevant service from a console-capable session.
- Immediately run the live listing commands again and test the service locally and externally.
Red Hat describes the iptables service as flushing and reloading rules from its saved files, unlike firewalld, which applies differences at runtime. That distinction explains why a restart can remove an ad-hoc rule that was never saved.
7. Diagnose rules that disappear after reboot
A disappearing rule almost always means it was added to the wrong layer or never persisted.
- If firewalld is active, check whether the change was made only in runtime configuration. Use the permanent form, reload, and verify both views.
- If iptables-services is active, check whether the rule exists in
/etc/sysconfig/iptablesor/etc/sysconfig/ip6tables, and whether the corresponding service is enabled. - If both managers are enabled, resolve the ownership conflict instead of saving the same policy in two places.
- If a provider image or configuration-management system rewrites firewall settings at boot, inspect its startup jobs and logs.
Reboot verification should be a controlled test: preserve a console session, confirm SSH is allowed, reboot, then run the same status, listing, and connectivity commands. A successful pre-reboot test does not prove persistence.
8. Treat IPv4 and IPv6 as separate paths
When IPv4 works but IPv6 fails, inspect every IPv6 component independently:
- Confirm the service listens on an IPv6 address with
ss -lntup; an IPv4-only bind will not accept IPv6 connections. - List
ip6tableschains with counters and line numbers. - Check the VPS provider’s IPv6 routing, exposure controls, and security group.
- Test from an external client that actually has IPv6 connectivity.
- Verify that firewalld’s active zone and permanent configuration cover IPv6 as intended.
Do not “fix” an IPv6 failure by changing only IPv4 rules. The two families have separate tables, services, counters, and upstream controls.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →9. Use logs to find syntax, startup, and lock failures
Service status tells you whether a unit is active; the journal often explains why it failed or reverted.
journalctl -u firewalld -b
journalctl -u iptables -b
journalctl -k -b
journalctl -p err -bThe -b option limits output to the current boot. Add a time range or priority filter when the journal is large. Kernel messages can reveal packet-filter errors, module problems, or interface events that are not visible in the service log.
Investigate lock-related startup errors
On RHEL 7, Red Hat documented a race between iptables and ip6tables startup that could produce lock-related failures. An update added the --wait option to restore commands. If a service fails with a lock message:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Capture the exact error from
systemctl statusand the journal. - Check installed package versions and available updates for the release.
- Confirm that iptables and ip6tables are not being started concurrently by conflicting unit files or custom scripts.
- Apply the release-appropriate update, then restart one service at a time and recheck both families.
Do not delete lock files or repeatedly restart services without reading the journal; that can hide the underlying race or leave an incomplete policy.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →10. Include the provider firewall and network path
A VPS can have at least three filtering layers: the application, the host firewall, and the provider’s network firewall or security group. A packet must pass all of them. Check whether the provider requires an inbound rule for the port, whether the rule applies to the correct VPS interface, and whether IPv6 has a separate policy.
Use a known external client and record its source address. A host rule restricted to a different source CIDR will not match your test. If the host’s counters stay at zero during a remote attempt, the packet may be stopped upstream or sent to a different address family or interface.
11. Common failure patterns and the precise fix
| Symptom | Likely cause | What to check |
|---|---|---|
iptables -L looks empty, but traffic is blocked |
firewalld owns the policy, or another table/manager is active | Check firewalld state, active zones, and the provider firewall; inspect all relevant tables. |
| A newly added rule has zero packet and byte counters | Wrong chain, interface, address family, source, protocol, or an earlier rule wins | List with -v --line-numbers, generate one test packet, and compare counters. |
| The rule works until reboot | Runtime-only change or disabled persistence service | Compare firewalld runtime/permanent views or save the iptables-services policy and enable both families as needed. |
| IPv4 succeeds but IPv6 times out | No matching ip6tables/firewalld rule, IPv6 bind or route issue, or provider IPv6 filtering | Inspect ip6tables, listener addresses, provider controls, and an IPv6-capable external client. |
| Restart removes a manually inserted rule | iptables-services flushed the live policy and restored its saved file | Save the tested policy through the owning service before restarting. |
| Remote access is lost after a reload | SSH rule missing from the active zone or chain, or default policy changed | Use the provider console, restore the backup, and add a narrowly scoped SSH allowance before further edits. |
| Service fails during boot with a lock error | iptables/ip6tables startup race or package issue | Read current-boot journal entries, check package versions, and apply the release-specific update. |
12. Version and backend cautions
CentOS 7 and RHEL 7 documentation describes iptables-services files in /etc/sysconfig and firewalld configuration under /usr/lib/firewalld/ and /etc/firewalld/. CentOS Stream and newer RHEL-derived systems can use nftables backends and compatibility commands, so command output and service names may differ. Before following a legacy procedure, run cat /etc/centos-release, identify installed firewall packages, and confirm which unit is enabled.
A compatibility command named iptables does not necessarily mean that the legacy iptables-services persistence model is active. Ownership and effective rules matter more than the command name.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors13. A safe end-to-end troubleshooting sequence
- Preserve access. Open a provider console or out-of-band session before changing a remote firewall, and keep a second SSH session available.
- Record the symptom. Test the service locally and from an external IPv4 and, where applicable, IPv6 client. Note whether the result is a refusal, timeout, or application error.
- Confirm the listener. Run
ss -lntupand verify protocol, port, and bind address. - Identify the owner. Run firewalld and iptables service-state checks; do not edit the other manager’s files.
- Inspect live rules. Use counters and line numbers for IPv4 and IPv6, including NAT when relevant. Save backups before edits.
- Trace one packet. Generate a single controlled connection and see which counters change. Check chain order and every match condition.
- Check upstream controls. Verify the provider security group, network firewall, route, and address family.
- Read logs. Review firewalld or iptables service logs, kernel messages, and current-boot errors for syntax, package, and lock failures.
- Change the owning manager. Use firewalld’s zone and permanent configuration, or save the verified iptables-services files. Do not maintain competing policies.
- Reload and verify. Re-list effective rules, repeat local and remote tests, and confirm counters increase on the intended rule.
- Reboot only as a deliberate persistence test. Keep console access, reboot, and repeat the same checks after startup.
14. Recovery when a change blocks SSH
Stop making remote edits once the connection becomes unreliable. Open the VPS provider’s console, restore the last known-good policy from the backup, and verify the SSH listener and firewall rule locally. If firewalld is the owner, restore its zone configuration rather than inserting an isolated iptables rule that will be overwritten. After access is restored, document the correct manager, persist the tested change, and perform a controlled reload before attempting another reboot.
The reliable diagnosis is therefore procedural: determine ownership, reproduce the failure on the correct address family, inspect the live ordered rules with counters, include the provider’s network controls, read the boot and service logs, and persist the fix through the manager that owns the policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
