# Edit iptables to open a port the safest and easiest way (nano?)

I have this web application called HaasBot (running on Mono 5) which I want to run on my Raspberry Pi 3 with Raspbian Stretch Lite (Terminal only!) as a server internally in my network only. Using SSH to do this by the way. The Pi has the OS freshly installed, no other things besides than dirmngr (as I recall correctly) and Mono 5 are installed. Iptables was installed by default. The whole OS is updated and upgraded to it*s latest state of course. The web app can not be considered "installed", because it was just a zip file I extracted, so nothing big there. Also no firewall installed, I also own no hardware firewall. We have a fritzbox and a network-security-server in our business network, where I am connected to. But as said, would need to open the port first anyway since it is required anyway before I can start finding the error with the fritzbox or the network-security-server. My own little network runs closed behind the main network where the fritzbox and the network-security-server is sitting infront of. My Wireless Lan router and the LAN hub (Pi connected by LAN cable of course) are just forwarding the connection to my very own little network.

The application itself is running, it needs the port 8090 and 8092. 8090 seems for incoming connections and 8092 for outgoing connections because when I try to access the web application from another computer's browser by typing in http://192.168.1.202:8090/ it loads my splash page, tries to receive data from the internet but doesn't finish doing so. Current state: Still the web app does not receive any data. It is stuck at the splash page where it says "Connecting to Haasonline Trade Server" Also the web app can only be accessed when typing in "http://192.168.1.202:8090/" in the browser, trying "http://192.168.1.202:8092/" doesn't display the web app

Checking for closed ports with

nmap -p 8092 192.168.1.202


it responds with

PORT: 8092/tcp STATE: closed SERVICE: unknown


Checking it with the port 8090 says the port is opened. Update: As of now it still says the port 8092 is closed. Before I can go and find the error somewhere else I would need to get and keep that port opened anyway first.

I did try Google with several differnt searches and asked here and there, but still no luck getting the port 8092 opened. I only know that if I get it opened and everything works, that I need to enter this command to keep it saved in case I need to reboot my Pi:

iptables-save >/etc/iptable


or to restore the default settings I would need to do this:

iptables-restore </etc/iptables


The command to open the port I already tried was:

sudo iptables -A INPUT -p tcp --dport 8092 -j ACCEPT


and it didn't open the port.

I also was told to run this command to open the port which maybe could help:

iptables -t nat -A PREROUTING -i lo -p tcp -d 127.0.0.1 --dport 8092 -j DNAT --to-destination 192.168.1.202:8092


Update this command also didn't do the trick But now I am getting confused of what is right and what is the wrong command and maybe wanted to get it confirmed here how to do it correctly.

Using the command

netstat -tnlp


responds with 3 lines where I find 1 line containing the internal network IP and the port 8090, it goes as following:

PROTO: tcp RECV-Q: 0 SEND-Q: 0 LOCAL ADDRESS: 192.168.1.202:8090 FOREIGN ADDRESS: 0.0.0.0:* STATE: LISTEN PID/Program name: 608/mono


Could anyone shed some light into this? I honestly do not understand these flags from all these commands and would be more comfortable simply editing a file with

sudo nano


to get this iptables thing right. But if not possible and I really get told the correct command, I would also be fine just pasting it into my ssh command window as a 1 liner-command with several flags that are puzzling me.

Thanks to everyone who could help me out with the correct solution and maybe an ELI5 explanation why the first command did not work.

Thanks again!

PS: Displaying the commands as code doesn't quite work for me here on raspberrypi.stackexchange. Also would love to get help for that! Until then hope you guys still can read it.

• Unless you configured a firewall iptables is not likely your problem. – Steve Robillard Feb 18 '18 at 21:48
• Ditto. And if you have configured a firewall, it might be easier to use whatever software front end you used for that. You don't have to mess with iptables. But if you want an exhaustive guide: iptables.info – goldilocks Feb 18 '18 at 21:50
• The Raspbian Stretch Lite is freshly set up with only Mono, dirmngr and the web application itself installed. Never messed with a firewall. Would just like to get the port open and have it working. Btw I edited my post with more explanations! – MeebusJaximus Feb 18 '18 at 21:52
• Then there's no firewall. You can confirm this with sudo iptables -L. It should show three chains with a default policy of ACCEPT and not much else. If this isn't the case, edit what's there into the question. "Displaying the commands as code doesn't quite work for me" -> Highlight and use the { } icon in the editor top bar. There's also a handy ? help icon there, far right. – goldilocks Feb 18 '18 at 21:54
• "Would just like to get the port open" -> Beware the XY problem. – goldilocks Feb 18 '18 at 21:56

Chain INPUT (policy ACCEPT)
TARGET: Accept, PROT: tcp, OPT: --, SOURCE: anywhere, DESTINATION: anywhere, tcp dpt: 8092
Chain FORWARD (policy ACCEPT)
Chain OUTPUT (policy ACCEPT)


As per Steve's first comment, your culprit here is not iptables, meaning there is no firewall configured on your Pi. The default in this case is the three lines above starting with "Chain" and a policy of ACCEPT. This applies to any connection not selected by a rule, and it means the connection will be accepted. Since you only have one rule, that applies to just about everything. The rule you do have is actually superfluous, since it also indicates ACCEPT. That's defined on the second line above and is presumably something you did to try and fix things on port 8092. Unless you've added that to a boot script, it will disappear on reboot (but as just explained, it is irrelevant anyway).

Checking it with the port 8090 says the port is opened. Update: As of now it still says the port 8092 is closed.

"Closed" does not mean blocked by a firewall; in that case nmap will say "filtered". However, if you run it from the same machine, you are behind the firewall, so you would just get "closed". But again: You don't have a firewall configured, so this is pretty definitive. The port is closed.

But closed in this context does not mean nothing is using the port. It means nothing is listening on the port. If a port is in use by a listening server, it will be reported as "open". However, if a port is in use by a client application, it will be reported as "closed", since nothing can connect to it. That's the perspective.

8090 seems for incoming connections and 8092 for outgoing connections

Outgoing connections are those of a client to a server. So what you have here doesn't indicate anything is wrong. You can confirm this while the application is running with:

lsof -i TCP:8092


This may be complicated by the fact that it seems unable to make the connection it wants to make. However, the problem is not with the Pi or the operating system. It is within the application or the outside network (e.g, the actual remote host).

• As said it is the application which opens the port, not iptables. If there is no security issue I suggest iptables --flush to eliminate side effects. Then look at the application why it is not opening the port. Often you can configure the port that should be used. Are you sure it is port 8092 and not 8091? Is sending of data enabled? – Ingo Feb 19 '18 at 14:41
• @Ingo Most likely the application is opening the port -- and making an outgoing connection. The confusion comes from the fact that nmap will report a port in use by a client as "closed", because it is not a server port, and therefore not open for connections. That the application gets stuck on "Connecting to Haasonline Trade Server" is probably a failure of the application or the remote host. – goldilocks Feb 19 '18 at 16:00
• Hmm... have to read the thing once again .. – Ingo Feb 19 '18 at 23:56

The problem got solved by using the following commands:

sudo apt-get install ufw
sudo ufw allow 22
sudo ufw allow 8090
sudo ufw allow 8092
sudo ufw enable
sudo reboot


And everything was just fine. Also there was just also a little issue with the web app's splash page.

I thank everyone for all recommendations and answers! I will upvote what I can! Thanks guys for your time and have a good day!