The lab needed a new Redis server as an internal public service, so I put together a weird little box with 20 GB of RAM and a 15 GB disk.
Its OS is CentOS, basically a bare install. After spinning it up from an ISO, I ran a yum update, added tmux and Redis, did all the configuration, ran chkconfig redis on, and then patted myself on the back.
[root@localhost ~]# redis-cli ping
PONGThis kind of trivial task is no pressure at all—writing code, watching OreImo, and fixing the OS, all at the same time, with zero stress. When I wrapped up, I casually tested a remote ping—just going through the motions—and unexpectedly didn't get the expected PONG.
[yu@argcv ~]$ redis-cli -h xx.xx.xx.xx
Could not connect to Redis at xx.xx.xx.xx:6379: No route to host
not connected> WTF is going on?
If the Redis .conf file contains something like the following:
bind 127.0.0.1then it will be configured to only accept local requests. I already knew that, so I had already set it to
# If you want you can bind a single interface, if the bind option is not
# specified all the interfaces will listen for incoming connections.
#
# bind 127.0.0.1
bind 0.0.0.0without error, so why was there still a problem?
I Googled for a long time; most results were stupid mistakes, like the service not knowing what it had started. Sifting through the mess, I finally found a key clue: iptables.
iptables is an important tool for managing system I/O. Its pile of rules tells the system what to do when traffic comes from a given address, and it also serves as a firewall and logging mechanism. After CentOS is installed, it comes with a bunch of preset rules, which left my beloved Redis trapped inside the VM.
With the commands
# iptables -L -nor
# iptables --listyou can see a set of CentOS preset rules. I wasn't sure exactly which rule was blocking things. Anyway, it's on the internal network, so I tried turning it off first.
On RHEL-based distros you can do it with:
/etc/init.d/iptables save
/etc/init.d/iptables stopThen I tried again and it worked. So that was indeed the issue.
Other distros can also use the following commands—they work for RHEL users too. The gist is to delete all iptables rules.
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -XAfter applying them, things usually work fine.
Of course, a firewall is still necessary, and security can't be ignored. My VM is used on the internal network, so I can be a bit casual about security. But once it faces the public internet, you need to do things properly. For iptables configuration, refer to reference 2.
Normally, Redis opens and listens on port 6379; you usually only need to open this port.
iptables -A INPUT -p tcp --dport 6379 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 6379 -j ACCEPTThat opens I/O for port 6379.
Then save.
One thing to note: CentOS no longer uses iptables by default, so something odd may happen after a reboot. You may want to check out this for the configuration.
Comments · 6