Forwarding Ports to Compute Instances

Preparing the Compute Instance

Oracle's pre-prepared Ubuntu Server images have a lot of iptables rules configured, one of which disallows all incoming traffic apart from TCP port 22 (SSH) and ICMP. Since our Compute Instance is behind a NAT network (the Oracle VCN) it is safe to remove these rules.

Checking the current iptables rules

First, use this command to see the current iptables rules:

sudo iptables --list --line-numbers

Which should give an output similar to this:

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
2    ACCEPT     icmp --  anywhere             anywhere            
3    ACCEPT     all  --  anywhere             anywhere            
4    ACCEPT     udp  --  anywhere             anywhere             udp spt:ntp
5    ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
6    REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Removing the REJECT rule

The line we are interested in removing contains REJECT. In this case, it is line 6. To remove it, we can use the following command:

sudo iptables -D INPUT 6

Confirming that the rule has been deleted

Now, rerun the list command to confirm that the REJECT rule has been deleted:

sudo iptables --list --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
2    ACCEPT     icmp --  anywhere             anywhere            
3    ACCEPT     all  --  anywhere             anywhere            
4    ACCEPT     udp  --  anywhere             anywhere             udp spt:ntp
5    ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh

Creating an Ingress Rule in Oracle Cloud

We've now deleted the REJECT rule in our Compute Instance, so we now need to modify the VCN to add an ingress rule (aka port forward) to our Compute Instance.

Compute Instance

To do this, go to your Compute Instance and click on the subnet link at the bottom (under the Primary VNIC section)

Subnet

Once in the subnet, go to the Security Lists section and click on the Default Security List:

Creating the Ingress rule

Click Add Ingress Rules. If you don't want to restrict the source IP address, enter 0.0.0.0/0 in the CIDR. Otherwise, specify the allowed IP address with a /32 on the end. Choose the protocol (in this example I am using TCP) and specify the destination ports (in this example 80 & 443). If you'd like, you can also add a description.