-2

I have the following rules set up:

  iptables -F
  iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT
  iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT
  iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
  iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
  iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
  iptables -A INPUT -i lo -j ACCEPT
  iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
  iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
  iptables -A INPUT -p tcp -m tcp --dport 12344 -j ACCEPT
  iptables -P OUTPUT ACCEPT
  iptables -P INPUT DROP

For some reason all outbound traffic is blocked, even though iptables -P OUTPUT ACCEPT is set.

What am I doing wrong?

Or W
  • 99
  • 3
  • 10
  • Fisrtly, can we see your whole ruleset (paste the output of `iptables -L -n -v` into the question). Secondly, could you show us an example of "*all outbound traffic [being] blocked*"? Your `INPUT` rules don't allow any DNS responses, for example, so I suspect that's more likely the issue than the blocking of outbound traffic. – MadHatter May 19 '14 at 08:40
  • @MadHatter Thanks, you were right, it was a combination of not having a rule to allow DNS connections and also David's answer. When I added the rules for DNS I saw it was resolving hosts but server was still not getting responses. After I've added the rule that David metnioned it worked. Thanks – Or W May 19 '14 at 09:07

1 Answers1

2

I believe the problem is most likely issues relating to the returning traffic being rejected. Try adding a new line 2 reading

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

To allow connections related to outbound connections you made to go through.

Jenny D
  • 27,780
  • 21
  • 75
  • 114
davidgo
  • 6,222
  • 3
  • 23
  • 41
  • I've just added that rule, still not getting through – Or W May 19 '14 at 08:49
  • I wouldn't add the `RELATED`, unless I was sure I needed it. Many do, but it's always struck me as cargo-cult programming. It leaves your state engine entirely at the mercy of your current set of loaded kernel modules. – MadHatter May 19 '14 at 08:49
  • The next thing to do might be to try a tcpdump to see what traffic is hitting your router, then trying to make a connection and see whats going on. Also, can you confirm that the Linux is a host and not a router. (If its a router you need to look at the FORWARD chain). Can you do an iptables -vnL and provide more details of a specific thing which is failing ?) – davidgo May 19 '14 at 08:52
  • @madHatter - I like being able to use FTP and other (what I consider broken protocols) without too much fiddling around, but yes, for simple HTTP type connections you can leave out related. – davidgo May 19 '14 at 08:54
  • 1
    Thanks, adding this rule and also allowing DNS connections did the trick – Or W May 19 '14 at 09:08