解决方案

本地服务器上的防火墙正在丢弃来自其他服务器的入站连接尝试。

1. 确定是否正在使用 FIREWARLD 服务。

# systemctl status firewalld.service

Dec 21 15:04:01 testserver firewalld[18880]: WARNING: ICMP type 'beyond-scope' is not supported by the kernel for ipv6.
Dec 21 15:04:01 testserver firewalld[18880]: WARNING: beyond-scope: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Dec 21 15:04:01 testserver firewalld[18880]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.
Dec 21 15:04:01 testserver firewalld[18880]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Dec 21 15:04:01 testserver firewalld[18880]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Dec 21 15:04:01 testserver firewalld[18880]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.

2. 确定是否正在使用 IPTABLES 服务。

# systemctl status iptables.service
* iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
Active: active (exited) since Thu 2017-12-21 17:51:12 UTC; 26min ago 
Process: 440 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
Main PID: 440 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/iptables.service
Dec 21 17:51:12 testserver systemd[1]: Starting IPv4 firewall with iptables...
Dec 21 17:51:12 testserver iptables.init[440]: iptables: Applying firewall rules: [ OK ]
Dec 21 17:51:12 testserver systemd[1]: Started IPv4 firewall with iptables.

3. 在 CentOS/RHEL 7 之前，使用 iptables 命令检查系统防火墙足以知道是否正在使用防火墙。
   例如，检查：

# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:domain
ACCEPT tcp -- anywhere anywhere tcp dpt:domain
...
INPUT_direct all -- anywhere anywhere
INPUT_ZONES_SOURCE all -- anywhere anywhere
INPUT_ZONES all -- anywhere anywhere
DROP all -- anywhere anywhere ctstate INVALID
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

足以确定如何控制防火墙规则。
在 CentOS/RHEL 7 中，新的 FIREWARLD 服务或者旧的 IPTABLES-SERVICE 都可以控制防火墙规则。
所以两者都需要检查以确保。

问题

应用程序从其他服务器收到“连接被拒绝”。
该应用程序可从 localhost 访问，并且它还侦听预期的端口。