Why opening ports in Oracle cloud fails: security lists vs Linux iptables

When spinning up a virtual instance on Oracle Cloud Infrastructure (OCI) to run a custom web application or container, developers almost always run into the same roadblock: you configure the ingress rule in the web console, yet external connections either time out or get refused.

The reason is straightforward: in OCI, opening a port requires aligning three independent layers before traffic can ever reach your application code.

1. The 3 network blocking layers in OCI#

When an external client attempts to connect to your instance, the packet follows this path:

[External Client] 
       │
       ▼
1. Cloud Edge (VCN / Security Lists / NSG)
       │
       ▼
2. Linux Kernel (iptables / nftables / firewalld)
       │
       ▼
3. Application Socket (Binding to 0.0.0.0 or :::)

1. Cloud Edge (VCN): Ingress rules applied to the subnet (Security List) or VNIC (NSG). If missing here, the packet is discarded before entering the VM.
2. Linux Kernel: Official OCI images (Ubuntu, Oracle Linux, RHEL) ship with active firewalls rejecting non-SSH traffic by default.
3. Application Socket: Your application must listen on wildcard addresses (0.0.0.0). If bound only to 127.0.0.1, the kernel will reject external connections.

2. Opening ports cleanly#

Step 1: Open the port in the OCI console (Security Lists)#

Following recent Oracle Cloud Infrastructure (OCI) console updates, the navigation flow and network menus have been reorganized. Here is the updated step-by-step path:

1. Navigate to Virtual Cloud Networks: Open the navigation menu in the top-left corner (hamburger icon), hover over Networking, and select Virtual cloud networks.

1. Select your VCN: In the virtual cloud networks list for your compartment, click your active VCN name (for instance, vcn-20240512-2324).

1. Access Security Lists: On the left navigation pane under Resources, click Security Lists and choose the security list attached to your subnet (typically Default Security List for vcn-...).

1. Add Ingress Rules: Inside the security list view, switch to the Security rules tab and click Add Ingress Rules.

In the ingress rule creation dialog, fill in the parameters:

• Stateless: Keep unchecked by default (stateful filtering automatically allows response packets without needing reverse rules).
• Source Type: CIDR
• Source CIDR: 0.0.0.0/0 (for public Internet access) or your specific source IP to restrict exposure.
• IP Protocol: TCP (or UDP, depending on your application).
• Source Port Range: Leave blank (permits incoming packets from all client ephemeral ports).
• Destination Port Range: The port your server application listens on (e.g. 8088, 9090, or 22 for SSH).
• Description: A descriptive label (e.g. SSH port rule or App web dashboard).
• Click Add Ingress Rules.

To automate via CLI:

# Add TCP ingress rule via OCI CLI
# Warning: the update command overwrites all ingress rules.
# Query existing rules first with 'oci network security-list get' to merge with existing entries (e.g. SSH port 22) or use a dedicated NSG.
oci network security-list update \
  --security-list-id <SECURITY_LIST_OCID> \
  --ingress-security-rules '[{"source": "0.0.0.0/0", "protocol": "6", "tcpOptions": {"destinationPortRange": {"min": 8088, "max": 8088}}}]'

Step 2: Adjust internal Linux firewall rules#

On Ubuntu / Debian in OCI#

# 1. Insert rule at top of INPUT chain
sudo iptables -I INPUT 1 -p tcp --dport 8088 -j ACCEPT

# 2. Persist rules across reboots
sudo apt-get install iptables-persistent -y
sudo netfilter-persistent save

On Oracle Linux / RHEL#

sudo firewall-cmd --zone=public --add-port=8088/tcp --permanent
sudo firewall-cmd --reload

Step 3: Verify socket bindings#

Check that your process is listening on public interfaces:

sudo ss -tulpn | grep 8088

• Correct: 0.0.0.0:8088 or *:8088
• Incorrect (local only): 127.0.0.1:8088

3. Pinpointing where the connection drops#

Run a test from your local development machine:

# Test remote port via Netcat
nc -zv -w 3 <OCI_PUBLIC_IP> 8088

Conclusion: practical tips for OCI networking#

1. Always persist iptables rules: On OCI Ubuntu, in-memory iptables edits vanish on reboot unless saved with netfilter-persistent save.
2. Use Network Security Groups (NSGs): Security Lists apply to the entire subnet. If you only want a port open on one machine, use an NSG.
3. Inspect packet counters: Run sudo iptables -L INPUT -n -v and check if the pkts count increments when you attempt a connection.
4. Tune memory architecture: On ARM/Free Tier instances with constrained memory, set up an appropriate Linux kernel swapfile to prevent OOM killer crashes under traffic spikes.

See also

Servers From 'no route to host' to virtual host: debugging standalone Nginx and cloud networking

Infrastructure From LSM to Netfilter in OCI: Demystifying SELinux and Opening Ports on Ubuntu Minimal 24.04

Infrastructure The day Rocky Linux 8 kernel "broke" my iptables (and how i fixed it)

This post is licensed under CC BY-NC.