Unable to open tcp ports 80 and 443 in RHEL VM 9.5 kernel version to browse site.

Question

Unable to open tcp ports 80 and 443 in RHEL VM 9.5 kernel version to browse site.

Shiva Prasad Reddy Chokkareddy 20

Unable to open tcp ports 80 and 443 in in RHEL VM 9.5 kernel version to browse site. In NSG also ports 22,80 & 443 are allowed, only able to access port 22. No other firewall is configured other than NSG .

Mounika Reddy Anumandla 6,845 Reputation points Microsoft External Staff Moderator

2024-12-10T06:29:12.0833333+00:00

Hi Shiva Prasad Reddy Chokkareddy,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Did you follow the following steps?

Create an inbound security rule

https://learn.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal#create-an-inbound-security-rule

Associate your network security group with a subnet

https://learn.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal#associate-your-network-security-group-with-a-subnet
Shiva Prasad Reddy Chokkareddy 20 Reputation points

2024-12-10T06:47:11.93+00:00

Hi @Mounika Reddy Anumandla

Thanks for your suggestion, i have already done the settings which you have mentioned above, using app-gateway also i was able to access site.

Everything worked fine in the RHEL VM 9.4 after upgrading the kernel version to 9.5 i am getting the issue.
Mounika Reddy Anumandla 6,845 Reputation points Microsoft External Staff Moderator

2024-12-10T07:04:09.94+00:00

Hi Shiva Prasad Reddy Chokkareddy,

Thank you for your patience while we are reviewing your query.

Here are few suggestions to try and see if that helps fixing your issue.

Run any of the below commands and check if the ports are listening or not:

In case the ports 80 and 443 are not listening, the reason might be there is no program listening on port 80. If no service is listening on ports 80 or 443, start the necessary service

If the ports are not listening, then you can try adding them to internal firewall and ensure to save the firewall changes.Use below commands:

Ensure the application configuration has correct port binding (Listen 80) in the below file.

Once this is done, you have added the ports to internal firewall and the services are up and running on the required ports. Please try and see the ports are open or not using this link.

If the ports are still showing as closed, then it could be issue with the NSG.

As you mentioned that the ports are allowed on the NSG attached to the VM, there might be other NSG's impacting the subnet in which the VM is deployed. On the Azure Portal check if the Network interface of the VM has only the NSG that you have created associated with it.

Hope that helps.

If the comment is helpful, please click upvote on this post.
Shiva Prasad Reddy Chokkareddy 20 Reputation points

2024-12-10T07:26:00.7833333+00:00

Hi @Mounika Reddy Anumandla

Thank you for the suggestions.

Nginx service is listening on port 80 and regarding NSG association only one NSG has been associated and port 22 is able to connect from outside also, other than port 22 i am not able to connect any other ports after allowing in NSG also.
Mounika Reddy Anumandla 6,845 Reputation points Microsoft External Staff Moderator

2024-12-11T07:16:51.52+00:00
Hi Shiva Prasad Reddy Chokkareddy,

Thank you for replying back with further information.
After some more investigation, suggesting you the below troubleshooting steps:

Please check if the SELinux policy is blocking the ports. You can try disabling SELinux temporarily and see if that helps in resolving the issue. Here are the steps to disable SELinux:

Open the file /etc/selinux/config using any text editor.

Change the value of SELINUX to disabled.

Save the file and exit.

Reboot the VM.

After the VM reboots, try accessing the site again and see if the ports are open or not. If the issue still persists, then it could be a configuration issue with Nginx. checking the Nginx configuration file and ensure that the server block for port 80 and port 443 is configured correctly. It's possible that something changed with RHEL 9.5, such as changes in the default firewall configuration or SELinux. You can find RHEL 9.5 release notes here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/

As a temporary resolution, you can try rolling back to the previous version of the RHEL VM kernel. I suggest filing a support case to investigate this matter further. In case if you don't have a support plan please let us know here. We will be able to help you with a one time free support ticket.

Thank You!

If you have any further queries, do let us know.
Shiva Prasad Reddy Chokkareddy 20 Reputation points

2024-12-11T14:55:29.9733333+00:00

Hi Mounika Reddy Anumandla,

Thank you for your suggestion,

Tried disabling SELINUX but no luck.

I do not have any support plan, it will help full if your able to help you with a one time free support ticket

Thank you.
Prrudram-MSFT 28,281 Reputation points Microsoft Employee Moderator

2024-12-12T06:23:39.36+00:00

Hi @Shiva Prasad Reddy Chokkareddy

If the issue started after upgrading the kernel version to 9.5, it's possible that the upgrade may have caused some changes to the network configuration or firewall settings on the VM.

You can check if there are any changes to the network configuration by running the following command:
sudo nmcli connection show

This will show you the network connections on the VM. You can check if the network connection that the VM is using is configured correctly.

You can also check if there are any changes to the firewall settings by running the following command:

sudo systemctl status firewalld

This will show you the current firewall rules on the VM. You can check if there are any rules that are blocking traffic on ports 80 and 443.

If you are still unable to access the site after checking the network configuration and firewall settings, you may need to check the logs of the web server and the VM to see if there are any errors or issues that could be causing the problem.

You can check if the firewall is enabled on the VM by running the following command:

sudo systemctl status firewalld

If the firewall is enabled, you can add rules to allow traffic on ports 80 and 443 by running the following commands:

sudo firewall-cmd --zone=public --add-port=80/tcp --permanent
sudo firewall-cmd --zone=public --add-port=443/tcp --permanent
sudo firewall-cmd --reload

If the firewall is not enabled, then the issue could be related to the web server configuration. You can check if the web server is running and listening on ports 80 and 443 by running the following command:

sudo netstat -tlnp | grep -E '80|443'

If the web server is not running or not listening on ports 80 and 443, you may need to start or restart the web server service
Shiva Prasad Reddy Chokkareddy 20 Reputation points

2024-12-12T13:07:48.6666667+00:00
Hi Prrudram-MSFT,

Thank you for the suggestion,

Tried work around you suggested but no luck.

Below work around which i found helped me to solve the issue.

By adding the ports in the nft rules able to work with port 80 HTTP.

and for accessing port 443 HTTPS.

If SELinux is enforcing and causing issues, you can create a permanent solution to allow Nginx access to the certificate files.

Below connamds are used to add ports in nft rules.

sudo nft add rule inet filter input tcp dport 80 accept

sudo nft add rule inet filter input tcp dport 443 accept

Below commands used to Permanently Set SELinux to Permissive Mode.

Edit the SELinux configuration file:

sudo vi /etc/selinux/config

Change the SELINUX=enforcing line to SELINUX=permissive to make it permissive after reboot.

Reboot the server to apply the change.

Thank you all for the help and sugesstions.
Shiva Prasad Reddy Chokkareddy 20 Reputation points

2024-12-12T13:45:45.6733333+00:00
Hi Prrudram-MSFT,

Thank you for the suggestion,

Tried work around you suggested but no luck.

Below work around which i found helped me to solve the issue.

By adding the ports in the nft rules able to work with port 80.

and for accessing port 443 https.

If SELinux is enforcing and causing issues, you can create a permanent solution to allow Nginx access to the certificate files.

Below connamds are used to add ports in nft rules.

sudo nft add rule inet filter input tcp dport 80 accept

sudo nft add rule inet filter input tcp dport 443 accept

Below commands used to Permanently Set SELinux to Permissive Mode.

Edit the SELinux configuration file:

sudo vi /etc/selinux/config

Change the SELINUX=enforcing line to SELINUX=permissive to make it permissive after reboot.

Reboot the server to apply the change.
Prrudram-MSFT 28,281 Reputation points Microsoft Employee Moderator

2024-12-13T06:41:46.2066667+00:00

Hello @Shiva Prasad Reddy Chokkareddy ,

Good catch! Glad the issue is resolved for you finally. We will have this answer promoted by reposting it as answer. As an Original Poster(You) will not be able to accept your own answer. This is in the attempt to help others looking for a solution for a similar issue.

Thanks again for sharing the solution here. Have a good day!

Accepted answer

0 additional answers

Your answer

Mounika Reddy Anumandla 6,845 Reputation points Microsoft External Staff Moderator

2024-12-10T06:29:12.0833333+00:00

Hi Shiva Prasad Reddy Chokkareddy,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Did you follow the following steps?

Create an inbound security rule

https://learn.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal#create-an-inbound-security-rule

Associate your network security group with a subnet

https://learn.microsoft.com/en-us/azure/virtual-machines/windows/nsg-quickstart-portal#associate-your-network-security-group-with-a-subnet
Shiva Prasad Reddy Chokkareddy 20 Reputation points

2024-12-10T06:47:11.93+00:00

Hi @Mounika Reddy Anumandla

Thanks for your suggestion, i have already done the settings which you have mentioned above, using app-gateway also i was able to access site.

Everything worked fine in the RHEL VM 9.4 after upgrading the kernel version to 9.5 i am getting the issue.
Mounika Reddy Anumandla 6,845 Reputation points Microsoft External Staff Moderator

2024-12-10T07:04:09.94+00:00

Hi Shiva Prasad Reddy Chokkareddy,

Thank you for your patience while we are reviewing your query.

Here are few suggestions to try and see if that helps fixing your issue.

Run any of the below commands and check if the ports are listening or not:

In case the ports 80 and 443 are not listening, the reason might be there is no program listening on port 80. If no service is listening on ports 80 or 443, start the necessary service

If the ports are not listening, then you can try adding them to internal firewall and ensure to save the firewall changes.Use below commands:

Ensure the application configuration has correct port binding (Listen 80) in the below file.

Once this is done, you have added the ports to internal firewall and the services are up and running on the required ports. Please try and see the ports are open or not using this link.

If the ports are still showing as closed, then it could be issue with the NSG.

As you mentioned that the ports are allowed on the NSG attached to the VM, there might be other NSG's impacting the subnet in which the VM is deployed. On the Azure Portal check if the Network interface of the VM has only the NSG that you have created associated with it.

Hope that helps.

If the comment is helpful, please click upvote on this post.
Shiva Prasad Reddy Chokkareddy 20 Reputation points

2024-12-10T07:26:00.7833333+00:00

Hi @Mounika Reddy Anumandla

Thank you for the suggestions.

Nginx service is listening on port 80 and regarding NSG association only one NSG has been associated and port 22 is able to connect from outside also, other than port 22 i am not able to connect any other ports after allowing in NSG also.
Mounika Reddy Anumandla 6,845 Reputation points Microsoft External Staff Moderator

2024-12-11T07:16:51.52+00:00

Hi Shiva Prasad Reddy Chokkareddy,

Thank you for replying back with further information.
After some more investigation, suggesting you the below troubleshooting steps:

Please check if the SELinux policy is blocking the ports. You can try disabling SELinux temporarily and see if that helps in resolving the issue. Here are the steps to disable SELinux:

Open the file /etc/selinux/config using any text editor.

Change the value of SELINUX to disabled.

Save the file and exit.

Reboot the VM.

After the VM reboots, try accessing the site again and see if the ports are open or not. If the issue still persists, then it could be a configuration issue with Nginx. checking the Nginx configuration file and ensure that the server block for port 80 and port 443 is configured correctly. It's possible that something changed with RHEL 9.5, such as changes in the default firewall configuration or SELinux. You can find RHEL 9.5 release notes here: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/

As a temporary resolution, you can try rolling back to the previous version of the RHEL VM kernel. I suggest filing a support case to investigate this matter further. In case if you don't have a support plan please let us know here. We will be able to help you with a one time free support ticket.

Thank You!

If you have any further queries, do let us know.
Shiva Prasad Reddy Chokkareddy 20 Reputation points

2024-12-11T14:55:29.9733333+00:00

Hi Mounika Reddy Anumandla,

Thank you for your suggestion,

Tried disabling SELINUX but no luck.

I do not have any support plan, it will help full if your able to help you with a one time free support ticket

Thank you.
Prrudram-MSFT 28,281 Reputation points Microsoft Employee Moderator

2024-12-12T06:23:39.36+00:00

Hi @Shiva Prasad Reddy Chokkareddy

If the issue started after upgrading the kernel version to 9.5, it's possible that the upgrade may have caused some changes to the network configuration or firewall settings on the VM.

You can check if there are any changes to the network configuration by running the following command:
sudo nmcli connection show

This will show you the network connections on the VM. You can check if the network connection that the VM is using is configured correctly.

You can also check if there are any changes to the firewall settings by running the following command:

sudo systemctl status firewalld

This will show you the current firewall rules on the VM. You can check if there are any rules that are blocking traffic on ports 80 and 443.

If you are still unable to access the site after checking the network configuration and firewall settings, you may need to check the logs of the web server and the VM to see if there are any errors or issues that could be causing the problem.

You can check if the firewall is enabled on the VM by running the following command:

sudo systemctl status firewalld

If the firewall is enabled, you can add rules to allow traffic on ports 80 and 443 by running the following commands:

sudo firewall-cmd --zone=public --add-port=80/tcp --permanent
sudo firewall-cmd --zone=public --add-port=443/tcp --permanent
sudo firewall-cmd --reload

If the firewall is not enabled, then the issue could be related to the web server configuration. You can check if the web server is running and listening on ports 80 and 443 by running the following command:

sudo netstat -tlnp | grep -E '80|443'

If the web server is not running or not listening on ports 80 and 443, you may need to start or restart the web server service
Shiva Prasad Reddy Chokkareddy 20 Reputation points

2024-12-12T13:07:48.6666667+00:00

Hi Prrudram-MSFT,

Thank you for the suggestion,

Tried work around you suggested but no luck.

Below work around which i found helped me to solve the issue.

By adding the ports in the nft rules able to work with port 80 HTTP.

and for accessing port 443 HTTPS.

If SELinux is enforcing and causing issues, you can create a permanent solution to allow Nginx access to the certificate files.

Below connamds are used to add ports in nft rules.

sudo nft add rule inet filter input tcp dport 80 accept

sudo nft add rule inet filter input tcp dport 443 accept

Below commands used to Permanently Set SELinux to Permissive Mode.

Edit the SELinux configuration file:

sudo vi /etc/selinux/config

Change the SELINUX=enforcing line to SELINUX=permissive to make it permissive after reboot.

Reboot the server to apply the change.

Thank you all for the help and sugesstions.
Shiva Prasad Reddy Chokkareddy 20 Reputation points

2024-12-12T13:45:45.6733333+00:00

Hi Prrudram-MSFT,

Thank you for the suggestion,

Tried work around you suggested but no luck.

Below work around which i found helped me to solve the issue.

By adding the ports in the nft rules able to work with port 80.

and for accessing port 443 https.

If SELinux is enforcing and causing issues, you can create a permanent solution to allow Nginx access to the certificate files.

Below connamds are used to add ports in nft rules.

sudo nft add rule inet filter input tcp dport 80 accept

sudo nft add rule inet filter input tcp dport 443 accept

Below commands used to Permanently Set SELinux to Permissive Mode.

Edit the SELinux configuration file:

sudo vi /etc/selinux/config

Change the SELINUX=enforcing line to SELINUX=permissive to make it permissive after reboot.

Reboot the server to apply the change.
Prrudram-MSFT 28,281 Reputation points Microsoft Employee Moderator

2024-12-13T06:41:46.2066667+00:00

Hello @Shiva Prasad Reddy Chokkareddy ,

Good catch! Glad the issue is resolved for you finally. We will have this answer promoted by reposting it as answer. As an Original Poster(You) will not be able to accept your own answer. This is in the attempt to help others looking for a solution for a similar issue.

Thanks again for sharing the solution here. Have a good day!

Answer 1

Hi
As an original poster cannot accept their own answer, I am reposting it so that you can accept it an answer. Accepted answer will help other community members navigate to the appropriate solutions.

Issue: Unable to open tcp ports 80 and 443 in RHEL VM 9.5 kernel version to browse site.

Solution: Below work around which i found helped me to solve the issue.

By adding the ports in the nft rules able to work with port 80 HTTP.

and for accessing port 443 HTTPS.

If SELinux is enforcing and causing issues, you can create a permanent solution to allow Nginx access to the certificate files.

Below commands are used to add ports in nft rules.

sudo nft add rule inet filter input tcp dport 80 accept
sudo nft add rule inet filter input tcp dport 443 accept

Below commands used to Permanently Set SELinux to Permissive Mode.

Edit the SELinux configuration file:
```
 sudo vi /etc/selinux/config
```
Change the SELINUX=enforcing line to SELINUX=permissive to make it permissive after reboot.
Reboot the server to apply the change.

Thank You!

Share via

Unable to open tcp ports 80 and 443 in RHEL VM 9.5 kernel version to browse site.

0 additional answers

Your answer