IPTables问题：无法连接到mongoDB w/mongo shell-CentOS

Question

我在连接mongo shell时遇到问题。当我从iptable中删除所有指令时，我可以成功连接。CentOS 6.5，mongod正在运行。这是我得到的错误：

[samir@core ~]$ mongo 127.0.0.1:27017
MongoDB shell version: 2.4.9
connecting to: 127.0.0.1:27017/test
Wed Mar 12 00:42:12.193 Error: couldn't connect to server 127.0.0.1:27017 at src/mongo/shell/mongo.js:147
exception: connect failed

我也试着从蒙哥开始。

Mongod正在运行：

[samir@core ~]$ sudo service mongod start
Starting mongod: about to fork child process, waiting until server is ready for connections.
forked process: 2104
all output going to: /var/log/mongo/mongod.log
child process started successfully, parent exiting
                                                           [  OK  ]

mongo日志也没有给出任何指向：

***** SERVER RESTARTED *****


Wed Mar 12 00:44:30.634 [initandlisten] MongoDB starting : pid=2104 port=27017 dbpath=/var/lib/mongo 64-bit host=core.datafit.io
Wed Mar 12 00:44:30.634 [initandlisten] db version v2.4.9
Wed Mar 12 00:44:30.634 [initandlisten] git version: 52fe0d21959e32a5bdbecdc62057db386e4e029c
Wed Mar 12 00:44:30.634 [initandlisten] build info: Linux ip-10-2-29-40 2.6.21.7-2.ec2.v1.2.fc8xen #1 SMP Fri Nov 20 17:48:28 EST 2009 x86_64 BOOST_LIB_VERSION=1_49
Wed Mar 12 00:44:30.634 [initandlisten] allocator: tcmalloc
Wed Mar 12 00:44:30.634 [initandlisten] options: { config: "/etc/mongod.conf", dbpath: "/var/lib/mongo", fork: "true", logappend: "true", logpath: "/var/log/mongo/mongod.log", pidfilepath: "/var/run/mongodb/mongod.pid" }
Wed Mar 12 00:44:30.639 [initandlisten] journal dir=/var/lib/mongo/journal
Wed Mar 12 00:44:30.640 [initandlisten] recover : no journal files present, no recovery needed
Wed Mar 12 00:44:30.725 [FileAllocator] allocating new datafile /var/lib/mongo/local.ns, filling with zeroes...
Wed Mar 12 00:44:30.725 [FileAllocator] creating directory /var/lib/mongo/_tmp
Wed Mar 12 00:44:30.738 [FileAllocator] done allocating datafile /var/lib/mongo/local.ns, size: 16MB,  took 0.011 secs
Wed Mar 12 00:44:30.738 [FileAllocator] allocating new datafile /var/lib/mongo/local.0, filling with zeroes...
Wed Mar 12 00:44:30.753 [FileAllocator] done allocating datafile /var/lib/mongo/local.0, size: 64MB,  took 0.014 secs
Wed Mar 12 00:44:30.755 [initandlisten] waiting for connections on port 27017
Wed Mar 12 00:44:30.756 [websvr] admin web console waiting for connections on port 28017

我的 IPTables 如下所示：

Chain INPUT (policy DROP 49 packets, 3315 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 1665  130K ACCEPT     all  --  eth0   any     anywhere             anywhere            state RELATED,ESTABLISHED 
    2   128 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https 
   18  1080 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:27017 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:28017 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 987 packets, 156K bytes)
 pkts bytes target     prot opt in     out     source               destination         

如果我将输入指令设置为ACCEPT，mongo shell会工作:

[samir@core db]$ sudo mongo
MongoDB shell version: 2.4.9
connecting to: test
Welcome to the MongoDB shell.
For interactive help, type "help".
For more comprehensive documentation, see
    http://docs.mongodb.org/
Questions? Try the support group
    http://groups.google.com/group/mongodb-user
> 

Netstat -pln | rep 27017:

[samir@core db]$ sudo netstat -pln | grep 27017 
tcp        0      0 0.0.0.0:27017               0.0.0.0:*                   LISTEN      2178/mongod         
unix  2      [ ACC ]     STREAM     LISTENING     12125  2178/mongod         /tmp/mongodb-27017.sock

我的 iptables 输入策略一定有问题。有什么想法吗？

Answer 1

你也许想试试，替换这条线

iptables -A INPUT -s 127.0.0.1 -j ACCEPT

随着

iptables -A INPUT -i lo -j ACCEPT