Mailing-List: contact couchdb-user-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: couchdb-user@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of paul.joseph.davis@gmail.com
 designates 74.125.46.158 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=HSfaAYOvwjFJqXBab4YRNFLmCNgz+JKgUmNX5VCyOTm+KqH6LRWAl+lFOoYlsJjnZ4jXMYrFbJej9KfBMoudiIsxgBNn5dSactbR8ReFGRc5vz5/p6PlA/jCMC+lkPEjKH7MOJXyZinKEJFG0YR/1HP80wWZwUyNo/VOGioBg1Q=
Message-ID: <e2111bbb0804281112h15e79a9cp427602f39f010c8c@mail.gmail.com>
Date: Mon, 28 Apr 2008 14:12:20 -0400
From: "Paul Davis" <paul.joseph.davis@gmail.com>
To: couchdb-user@incubator.apache.org
Subject: Re: firewall
In-Reply-To: <5FB9C551-BBB5-4AD8-8BAE-528E28FC1C25@uci.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <FC4513C5-7896-4F65-9A8B-4CCB32F2372B@gmail.com>
	 <94947A5A-28C0-4ED2-98F4-0C780A9970FA@apache.org>
	 <43B3557F-C8DB-4580-A70E-8B5DCAF94C91@gmail.com>
	 <ACCA1844-974E-43A1-B665-D66695D9EE27@gmail.com>
	 <1DBCBFC4-6A33-4DAC-8981-7286773A623E@gmail.com>
	 <4624B2E1-C462-4191-BFBC-417267659399@apache.org>
	 <D8218852-48CC-40ED-86EC-EF18C6A0ED16@gmail.com>
	 <F1141FAC-F195-4743-8F08-236A4C959334@gmail.com>
	 <5FB9C551-BBB5-4AD8-8BAE-528E28FC1C25@uci.edu>

On Mon, Apr 28, 2008 at 2:03 PM, Tommy Chheng <tchheng@uci.edu> wrote:
> Hi,
>  I'm trying to get CouchDB to work as a server. I got it install and
> everything works from the same machine, ie, wget localhost:5984 gives a
> response.
>
>  but i want to access this server over the internet. I set an allow in
> iptables:
>  /sbin/iptables -A INPUT -p tcp -m tcp --sport 5984 -j ACCEPT
>  /sbin/iptables -A OUTPUT -p tcp -m tcp --dport 5984 -j ACCEPT
>
>  /sbin/iptables -L
>  Chain INPUT (policy ACCEPT)
>  target     prot opt source               destination
>  RH-Firewall-1-INPUT  all  --  anywhere             anywhere
>  RH-Firewall-1-INPUT  all  --  anywhere             anywhere
>  ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:5984
>  ACCEPT     tcp  --  anywhere             anywhere            tcp spt:5984
>
>
>  I'm able to connect to my webserver on this same machine fine. Just no
> response on 5984.
>
>  Any ideas what's wrong?
>
>  thanks,
>  tommy

I think this is your problem:
-A OUTPUT -p tcp -m tcp --dport 5984 -j ACCEPT

Try chaning the --dport to --sport. Or, also, you could just not
filter outbound traffic. Unless for some reason you don't trust code
running behind your firewall.

HTH,
Paul