I don't see anything immediately wrong, but it's been a long time since I've played with iptables. We'd probably need to see your entire chain to see if something else is overriding that. Also, are you sure the app isn't trying to use UDP also/instead?

EDIT: Oh, and someone recently (not me) linked to this tool to greatly simplify your life with building iptable rules. Folks in that thread seemed to like it: Firewall Builder.

You need to insert the rule for port 2222 before the REJECT rule that rejects the packets. Use something like
iptables -I INPUT 6 -p tcp --dport 2222 -j ACCEPTwhere 6 specifies the position in the chain (1-based) to insert the rule.

In fact, I'd suggest getting rid of that REJECT rule entirely and setting the input chain policy to DROP, which you can do by running the command
iptables -P INPUT DROPThat way any rules you may add in the future will automatically be applied before packets are dropped. (If you decide to use Firewall Builder, its default rule set will set the chain policy to DROP)

:) David

Whenever you are looking at iptables do an "iptables -L --line -nv", this will make it so iptables doesn't do lookups on ips/ports, is verbose and shows lines. Again it all depends on what you want to do with your iptables rules. I make mine a little bit more complex for connection tracking and such.

Quick suggestions
1. Set you input/forward chain rule to drop as policy, also put a default drop policy at the bottom of the input chain just in case. You should do a log then drop if this is anything critical that way you can see who may be trying to get into your system.
2. Setup related/established rules which can lower processing, these should be at the top.
3. Drop is your friend rather than reject.
4. You have an accept at the top making everything else null and void.
5. Make sure you check how large your connection tracking table if you plan on getting lots of traffic.
6. Rule #2 seems unnecessary.
7. I tend to go from low to high port, just makes things easier to read.

here is a small default. It doesn't include most of the advanced stuff as I'm sure thats overkill for what you want to do.

# Generated by iptables-save v1.3.5 on Fri Dec 12 11:47:24 2008
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [10034635:10151550141]
:mail - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 965 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 35000:35010 -j ACCEPT
-A INPUT -j DROP
COMMIT
# Completed on Fri Dec 12 11:47:24 2008

i'm on CentOS and the tutorial has you add the commands individually. how do I add commands like

*filter
:INPUT DROP [0:0]

a quick look at firewall builder look daunting...

Posted By: joek168i'm on CentOS and the tutorial has you add the commands individually. how do I add commands like

*filter
:INPUT DROP [0:0]

a quick look at firewall builder look daunting...

FYI the format RossH posted is a specialized iptables format used by Ubuntu only. The normal way to do
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [10034635:10151550141]would be
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

And Firewall Builder is kind of daunting at first but it makes a lot of sense once you figure it out. It took me a few hours to get used to it.

:) David

Posted By: RossHActually that is just the default iptables config file save format....

oh . . . yeah, I guess it is. My mistake.

However, Ubuntu is the only distribution for which I've seen anyone suggest editing the iptables rules file directly. The normal way to edit iptables rules is to use the iptables command.

:) David

i ended up saving the following into a file called myfirewall and making it executable, then running it.

#!/bin/bash
#
# iptables example configuration script
#
# Flush all current rules from iptables
#
iptables -F
#
# Allow SSH connections on tcp port 22
# This is essential when working on remote servers via SSH to prevent locking yourself out of the system
#
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
#
# Set access for localhost
#
iptables -A INPUT -i lo -j ACCEPT
#
# Accept packets belonging to established and related connections
#
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 20 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 965 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 35000:35010 -j ACCEPT
iptables -A INPUT -j DROP
#
# Save settings
#
/sbin/service iptables save
#
# List rules
#
iptables -L -v

------------------------------

thanks for all your help!

Yep, in my experience there's really no reason to accept any FORWARD packets if you're just running a server (web/email/database/etc.). That rule should almost certainly be in the INPUT chain.

For what it's worth: I have an (incomplete) IPtables tutorial on my website, http://www.ellipsix.net/geninfo/firewall/index.html, that might have some useful information for you. (Sorry if I already told you about this, I know I mentioned it to someone but I don't think it was on this thread)

:) David