0

When resetting IPTables, the apt-get and wget command functions correctly and also downloads what I want. But once I activate this firewall, it isn't functional. Pings still work.

I want to allow all outgoing connections. That's why I added "iptables -P OUTPUT ACCEPT" at the end.

IPTables Firewall: http://pastebin.com/pTGyiz7c

iptables -L -n -v: http://pastebin.com/6Q8Mbgfh

  • OK But what is really in iptables ? Could you add the result of "iptables -L -n -v" in your question ? – Dom Jan 29 '16 at 15:10
  • Yes, I have added it. –  Jan 29 '16 at 15:13
  • I don't see anything concerning the established connections in your firewall in INPUT. So you will not receive the packets from the outside. You must add a log at the end and check your logs to debug your firewall – Dom Jan 29 '16 at 15:13
  • Could you post the command? –  Jan 29 '16 at 15:14
  • Could you do the command when the firewall is active and filtering, not disabled :-) – Dom Jan 29 '16 at 15:15
  • Should now be there. –  Jan 29 '16 at 15:27

3 Answers3

0

basvdlei & Dom is answer is right,

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

but, wget or apt need one more thing: DNS add below line works fine in my situation

iptables -A INPUT -p udp --dport 53  -j ACCEPT
user3618389
  • 1
  • 1
0

You need to allow incoming packets, related to your outgoing connections.

iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

If that doesn't work:

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Differences are discussed here: https://unix.stackexchange.com/questions/108169/what-is-the-difference-between-m-conntrack-ctstate-and-m-state-state

Community
  • 1
basvdlei
  • 1,326
  • 8
  • 13
0

Your firewall is missing major part. The first packet go to outside correctely (as the OUTPUT policy is ACCEPT). The fist incoming packet is rejected as there is nothing allow in INPUT rule. You should have a iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT to allow the connection tracking to allow the packet to come. The second packet will be allowed to go out too as the OUTPUT policy is ACCEPT.

Add a rule to log what is reject is important. Add iptables -A INPUT -j LOG --log-prefix "DROP4 INPUT " at the end of the INPUT rule.

A remark : do you need all the opened ports in INPUT ? The mysql service opened to Internet is not really a good idea...

Dom
  • 6,743
  • 1
  • 20
  • 24
  • In my Firewall, I only allow MySQL, SSH and others to be opened in the IP subnet of my servers. Everyone outside will is blocked. –  Jan 29 '16 at 15:44
  • Oh wait, it doesn't! Thanks for letting me know. I will edit that now. A huge thanks for helping –  Jan 29 '16 at 15:46