What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When iptables appears not to work on a CentOS VPS, first find out which firewall manager owns the active policy. firewalld and the iptables-services stack are different systems; changing one while the other is active can leave you looking at stale rules or create conflicting behavior. Then verify the service is listening, inspect the live rules with counters and line numbers, test IPv4 and IPv6 separately, check the VPS provider’s network firewall, and only after that make a persistent change.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The procedure below is designed for a remote server, where an incorrect rule can end your SSH session. Keep an existing session open, use a provider console if available, and make one change at a time.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Start with the symptom, not the rule file
A firewall problem is often reported as “the port is blocked,” but the network symptom narrows the search:
| What you observe | What it usually means | First check |
|---|---|---|
| Connection refused | The host answered but no process is accepting that address and port, or a rule actively rejected the connection. | Check the listening socket with ss and inspect REJECT rules. |
| Connection timeout | Packets are being dropped, routed elsewhere, or stopped by an upstream firewall. | Check local DROP rules, the VPS provider’s security group, and the destination address family. |
| Works locally but not remotely | The service may listen only on loopback, or traffic is blocked in INPUT or by an external control plane. | Compare ss output with a test from another network. |
| Works over IPv4 but not IPv6 | IPv6 has its own rules and may have separate provider-level exposure. | Inspect ip6tables, the IPv6 listener, routing, and provider settings. |
Test from both sides before editing anything. On the VPS, use a service-specific probe or curl. From an external client, test the public address and port. A local success proves only that the application is running; it does not prove that packets can reach it through the complete path.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Identify which firewall manager owns the policy
Run these checks as root or through sudo:
systemctl is-active firewalld
firewall-cmd --state
systemctl is-active iptables
systemctl is-active ip6tablesIf firewalld is active, it is the management layer to use. The firewalld project warns that using iptables directly while firewalld is running can cause unexpected results. If the iptables services are active instead, their saved rule files are the persistence mechanism.
An inactive result does not always identify the whole path. A host can have a provider security group, a cloud network ACL, or another host-level component in front of the service. Also, a command can display compatibility rules while the kernel’s effective backend is nftables on newer releases.
Recommended Free Tools
Check the CentOS release and installed packages
cat /etc/centos-release
cat /etc/os-release
rpm -q firewalld iptables iptables-servicesCentOS 7 and RHEL 7 procedures commonly use iptables-services and the files /etc/sysconfig/iptables and /etc/sysconfig/ip6tables. CentOS Stream and newer RHEL releases may use nftables backends or compatibility commands, so do not assume that a CentOS 7 file layout or service behavior applies unchanged.
Why an empty saved file proves little
Firewalld normally stores its configuration as XML under /usr/lib/firewalld/ and /etc/firewalld/, not in /etc/sysconfig/iptables. An empty or missing iptables file therefore does not prove that the machine has no firewall policy. Inspect the manager that is actually active and the rules currently loaded in the kernel.
Take a safe snapshot before changing rules
Remote firewall work should be reversible. Keep one SSH session untouched while using a second session for diagnostics. If the VPS platform provides an out-of-band console, sign in to it before testing a rule that could affect SSH.
mkdir -p /root/firewall-backup
iptables-save > /root/firewall-backup/iptables-$(date +%F-%H%M%S).rules
ip6tables-save > /root/firewall-backup/ip6tables-$(date +%F-%H%M%S).rulesThe exports capture the currently loaded IPv4 and IPv6 policies, even when a service’s on-disk file is stale. Record the active zones and interfaces as well:
firewall-cmd --get-active-zones
ip -br address
ip route
ip -6 routeDo not flush all rules as a first diagnostic step on a production VPS. If a temporary rule is necessary, define its scope and an undo command before applying it, and verify SSH access before closing the original session.
Verify that the application is actually reachable on the VPS
A firewall cannot allow a service that is not listening on the expected address. Check sockets and processes:
ss -lntupLook for the intended TCP or UDP port and note the bind address. 127.0.0.1:PORT or ::1:PORT accepts local traffic only. A listener on 0.0.0.0:PORT covers IPv4 interfaces; a listener on [::]:PORT may cover IPv6 and, depending on the application’s socket settings, IPv4-mapped connections. Confirm the application’s own configuration rather than inferring behavior from the address alone.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Probe locally with the protocol the service uses, for example:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorscurl -v http://127.0.0.1:PORT/For a non-HTTP service, use its native client or a TCP probe from the VPS. Then repeat the test from an external network against the VPS’s public IPv4 and, separately, its public IPv6 address.
When firewalld is active: inspect zones and runtime state
Firewalld assigns interfaces and source networks to zones. The zone containing the interface that receives the packet is the policy that matters.
firewall-cmd --state
firewall-cmd --get-active-zones
firewall-cmd --get-zone-of-interface=eth0
firewall-cmd --list-all-zonesReplace eth0 with the interface shown by ip -br address. Inspect the selected zone directly:
firewall-cmd --zone=public --list-all
firewall-cmd --zone=public --list-services
firewall-cmd --zone=public --list-ports
firewall-cmd --zone=public --list-rich-rulesA service may be allowed by a named service definition, an explicit port, a rich rule, or an ipset. Conversely, an interface assigned to a different zone can make a rule in public irrelevant.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Understand runtime versus permanent configuration
Firewalld maintains a runtime configuration and a permanent configuration. A change made without --permanent affects the running firewall but is lost on reload or restart. A change made with --permanent is stored for future reloads but does not necessarily change the current runtime policy until you reload.
firewall-cmd --zone=public --add-port=8080/tcp
firewall-cmd --zone=public --permanent --add-port=8080/tcp
firewall-cmd --reload
firewall-cmd --zone=public --list-portsUse the port and zone appropriate to your service. Before opening SSH or an administration port, confirm that the existing access path remains allowed. After reloading, list the zone again and test from an external client. If a temporary experiment should become permanent, firewalld also supports transferring the runtime configuration with firewall-cmd --runtime-to-permanent; review the resulting policy instead of blindly copying an accidental test rule.
Check firewalld’s own logs and dependencies
systemctl status firewalld
journalctl -u firewalld -b
firewall-cmd --get-log-deniedSyntax errors, unavailable helpers, a failed reload, or a service that was restarted by another dependency will appear in the service journal. If you intentionally migrate away from firewalld, disabling it alone may not be sufficient: another dependency or D-Bus request can start it again. The deliberate migration procedure is to stop and disable it, mask it, then enable the iptables services only after confirming the replacement policy and console access.
When iptables-services is active: inspect the effective chains
Use both protocol families and include counters and line numbers:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
systemctl status iptables ip6tables
iptables -L -n -v --line-numbers
ip6tables -L -n -v --line-numbers
iptables -t nat -L -n -v --line-numbers
ip6tables -t nat -L -n -v --line-numbersThe verbose output includes packet and byte counters for each rule. Line numbers reveal the order in which rules are evaluated. A rule with zero packets may be correct but unused, or it may be unreachable because an earlier rule already accepted or dropped the traffic.
Inspect the complete saved representation when you need exact match conditions, policies, counters, and custom chains:
iptables-save
ip6tables-saveRead the chain policy as well as individual rules. A chain with policy DROP requires an explicit accept path; a policy of ACCEPT can make a later drop ineffective unless another chain is reached first.
Check the rule’s semantics
For a blocked inbound service, verify all of these fields:
- Table and chain: ordinary inbound filtering is usually in the
filtertable’sINPUTchain. NAT rules do not by themselves permit traffic. - Protocol and destination port: TCP and UDP are different; a TCP rule does not open the UDP service on the same number.
- Destination address: a rule for one public address does not necessarily match another address on a multi-homed VPS.
- Source and interface: a source restriction or
-iinterface match can exclude the client you are testing. - Connection state: established/related rules usually handle return traffic, while NEW traffic still needs an appropriate inbound rule.
- Order: the first matching terminal action wins. A broad DROP or REJECT above a narrow ACCEPT explains many “the rule is present but the port is blocked” cases.
After generating one test connection, run the listing again and see which counters increased. This is more reliable than reading a configuration file and guessing which rule handled the packet.
Check all relevant chains
If the VPS is forwarding traffic, inspect FORWARD in addition to INPUT. For locally generated connections, inspect OUTPUT. Port forwarding can involve both the nat table and filter chains; an address translation rule that matches does not override a later filter decision.
Test IPv4 and IPv6 as separate firewalls
IPv4 and IPv6 have separate rule sets and often separate provider controls. An IPv4 ACCEPT rule never authorizes an IPv6 packet. Compare listeners and rules explicitly:
ss -lntup
iptables -L -n -v --line-numbers
ip6tables -L -n -v --line-numbersFrom an IPv6-capable external client, test the literal IPv6 address using the client’s IPv6 option. Confirm that the VPS has a global IPv6 address, a default IPv6 route, and an application listener that accepts IPv6. Then check whether the provider exposes or filters IPv6 independently of IPv4.
Do not “fix” an IPv6 problem by weakening IPv4 rules. Build and verify an IPv6 policy with the same care, including required ICMPv6 traffic for neighbor discovery and path operation.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Distinguish host filtering from the VPS provider’s firewall
Many VPS platforms place a security group, network firewall, or account-level ACL before the virtual machine. A packet can be dropped before it reaches iptables, so the host counters remain at zero even though your local rule looks correct.
- Confirm the destination address and port from an external network.
- Check the provider control panel for inbound rules, source ranges, protocol, and IPv4 versus IPv6 scope.
- Verify that the VPS has the expected public route and that no load balancer or NAT layer changes the destination.
- Repeat the external test after changing only one layer, recording the time so provider logs and host journals can be correlated.
If the provider blocks the packet, changing local chains cannot resolve the timeout. If the provider allows it but local counters stay at zero, verify the interface, address family, and whether another local firewall backend is active.
Use logs to explain failed starts and reloads
Rule listings show policy; logs explain why a policy failed to load or why a service did not start:
journalctl -u firewalld -b
journalctl -u iptables -b
journalctl -u ip6tables -b
journalctl -k -b
journalctl -p err -bThe -b selector limits output to the current boot. Kernel messages can reveal rejected operations, missing modules, or backend errors. Service journals can expose malformed rules, unavailable commands, and ordering failures. Narrow a noisy journal by time with options such as --since and --until, or by priority with -p.
Investigate lock and package errors
If startup reports that a restore operation cannot obtain a lock, inspect the complete journal and installed versions:
rpm -q iptables iptables-services
systemctl status iptables ip6tables
journalctl -u iptables -u ip6tables -bRHEL 7 documentation describes a race in which the iptables and ip6tables services started together and competed during restore. Later updates added the --wait option to restore commands. Bring the relevant packages up to the current supported update for your CentOS release, then reboot or restart in a maintenance window and verify both services. Do not paper over a lock error by repeatedly starting and stopping units without checking which process owns the lock.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Make the fix persistent through the owner
Persistence with iptables-services
The iptables services load their saved policies from:
/etc/sysconfig/iptablesfor IPv4/etc/sysconfig/ip6tablesfor IPv6
After a tested runtime change, save it through the service tooling or export the exact rules:
service iptables save
iptables-save > /etc/sysconfig/iptables
ip6tables-save > /etc/sysconfig/ip6tablesUse one saving method deliberately and inspect the resulting files. Enable the services so they load at boot:
systemctl enable iptables ip6tables
systemctl start iptables ip6tablesOn a system where firewalld is meant to remain active, do not also enable iptables-services as a second policy owner. After saving, reload or reboot only when you have console access or a tested rollback path, then re-run the verbose listings and perform external checks.
Free tools Windows power users keep installed
One-click scans. No signup required.
Persistence with firewalld
Use firewalld’s permanent options, reload, and verify the resulting runtime zone. Editing iptables files directly will not make a firewalld rule persistent. If you are switching managers, first document the intended IPv4 and IPv6 behavior, stop and mask firewalld, confirm it is inactive, and then enable the iptables services. The reverse migration requires restoring firewalld ownership and expressing the policy in zones, services, ports, rich rules, or ipsets.
Use ipsets for large block lists
When many addresses must be blocked, repeatedly inserting individual rules creates a long, difficult-to-audit chain. CentOS infrastructure guidance demonstrates ipset-backed lists for fleet enforcement. An ipset lets one rule reference a set whose members can be updated without rewriting the entire filter policy.
Before adopting this pattern, verify that the ipset package and kernel support are installed for your release, decide whether the list is managed by firewalld or directly by iptables-services, and define how the set will be recreated at boot. Mixing an ipset managed by one layer with rules managed by another can recreate the ownership problem described above.
Firewalld or iptables-services: choose one owner
| Aspect | Firewalld | iptables-services |
|---|---|---|
| Policy model | Zones, services, ports, rich rules, and runtime/permanent configuration. | Ordered chains and rules stored in saved flat files. |
| Live changes | Changes can be applied to runtime configuration and reloaded without rebuilding the entire policy. | Service operations flush and reload rules from the saved files. |
| Persistence | Use --permanent, then reload or transfer reviewed runtime settings. |
Save to /etc/sysconfig/iptables and /etc/sysconfig/ip6tables. |
| IPv4/IPv6 | Manage both families through firewalld, but test each family independently. | Separate iptables and ip6tables services and files. |
| Remote-change safety | Runtime edits can be tested before committing them permanently. | Direct rule edits are precise but ordering and reload behavior require more care. |
| Typical failure | The interface is in another zone, or runtime and permanent settings differ. | The saved file is stale, a preceding rule wins, or the service failed to restore. |
The practical rule is simple: determine the owner, use that owner’s commands, and verify the kernel’s effective policy afterward.
A complete troubleshooting runbook
- Keep access safe: retain an SSH session and obtain console access if possible.
- Classify the symptom: distinguish refusal, timeout, local-only access, and IPv4/IPv6 differences.
- Verify the application: use
ss -lntupand a local probe to confirm the process and bind address. - Identify ownership: check firewalld and iptables service status, the CentOS release, and installed packages.
- Back up live rules: export both
iptables-saveandip6tables-save. - Inspect effective policy: list counters, line numbers, zones, interfaces, NAT tables, and chain policies.
- Generate one test packet: repeat the listing and identify which counter changed.
- Check outside the VM: review provider security groups, routes, and IPv4/IPv6 exposure.
- Read journals: investigate reload, syntax, kernel, package, and lock errors for the current boot.
- Apply one narrow fix: use firewalld commands when it owns the policy, or edit and save iptables-services rules when it does.
- Verify persistence: reload or reboot during a controlled window, then repeat local and external tests for both address families.
This sequence prevents the most common false conclusions: treating a saved file as the live policy, assuming IPv4 rules cover IPv6, mistaking a missing listener for a firewall block, and editing iptables while firewalld controls the host.
Frequently Asked Questions
Why does iptables show an ACCEPT rule but the port is still blocked?
Check the rule’s chain, interface, source, protocol, destination address, and position. A preceding rule may terminate processing, the packet may arrive on another interface or address family, or the VPS provider may drop it before it reaches the host. Generate a test connection and inspect which rule’s packet counter increases.
Why did my firewall rule disappear after reboot?
With iptables-services, the runtime rule must be saved to the appropriate /etc/sysconfig/iptables or /etc/sysconfig/ip6tables file and the service must load it at boot. With firewalld, use permanent configuration and reload it. Do not expect an iptables file to persist a firewalld change.
How can I tell whether a timeout is caused by my VPS provider?
If the application listens locally, the host rules permit the traffic, and the relevant counters remain at zero during an external test, inspect the provider security group or network firewall, routing, and IPv4/IPv6 exposure. A host rule cannot admit a packet discarded upstream.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
