Introduction

Recently, I set up an Apache web server on an Ubuntu-based Oracle Cloud (OCI) instance. Everything seemed fine—Apache was installed, running, and accessible locally. However, when I tried accessing it from an external machine, I was met with the dreaded No route to host error. After troubleshooting, I found the issue was related to firewall configurations. This blog post walks through the steps to diagnose and fix this issue, ensuring your Apache server is accessible externally.

Common Symptoms

If you are experiencing the following, your issue might be similar:

• Apache is installed and running (sudo systemctl status apache2 confirms it is active).
• Locally, curl -I http://localhost returns HTTP/1.1 200 OK.
• Running sudo ss -tulnp | grep :80 confirms Apache is listening on port 80.
• However, an external request (curl -I http://your_public_ip) fails with No route to host or Connection refused.

Diagnosing the Issue

Step 1: Check Firewall Rules

A common cause of this issue is firewall rules blocking external access to port 80.

Run:

sudo iptables -L -n -v

You might see a REJECT rule like this:

30  3296 REJECT all  --  *  *  0.0.0.0/0  0.0.0.0/0  reject-with icmp-host-prohibited

Even if Apache is allowed (ACCEPT tcp dpt:80), if the REJECT rule appears above the allow rule, external traffic will still be blocked.

Step 2: Adjust Firewall Rules

To allow external access, add this rule to insert the ACCEPT rule above the reject rule:

sudo iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT

Then save the rules permanently:

sudo iptables-save | sudo tee /etc/iptables/rules.v4

If you are using UFW (Uncomplicated Firewall), enable HTTP traffic:

sudo ufw allow 80/tcp
sudo ufw reload

Step 3: Check Cloud Security Rules

If your server is hosted on Oracle Cloud (OCI), AWS, or another cloud provider, they often have network security rules that act as an additional firewall. Ensure your ingress rules allow traffic on port 80:

1. For Oracle Cloud (OCI)
   • Log into the Oracle Cloud Console.
   • Navigate to Networking > Virtual Cloud Networks (VCN).
   • Click on your subnet and find Security Lists.
   • Ensure an ingress rule exists:
     • Source: 0.0.0.0/0
     • Port: 80
     • Protocol: TCP
2. For AWS EC2
   • Open the AWS EC2 Dashboard.
   • Go to Security Groups.
   • Ensure there is a rule allowing:
     • Port: 80
     • Protocol: TCP
     • Source: 0.0.0.0/0

Step 4: Restart Services

After making changes, restart networking and Apache:

sudo systemctl restart apache2
sudo systemctl restart networking

Step 5: Test External Access

From another machine, test again:

curl -I http://your_public_ip

If everything is set up correctly, you should see:

HTTP/1.1 200 OK

Conclusion

Firewall misconfigurations are one of the most common issues preventing external access to an Apache web server. By adjusting iptables, checking cloud security settings, and ensuring Apache is listening properly, you can resolve the No route to host issue efficiently. If you’re facing a similar problem, follow these steps, and your web server should be up and running in no time!