0

I've setup IPTables with the following script... however, I cannot get outgoing HTTP queries to work (I've tried using lynx & curl).

Background - server is hosted remotely (and I'm connecting via SSH).

Your help will be greatly appreciated...


Here's my iptables setup:

iptables -P INPUT ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # ssh
iptables -A INPUT -p tcp --dport 80 -j ACCEPT # http
iptables -A INPUT -p tcp --dport 443 -j ACCEPT # https
iptables -A INPUT -p tcp --sport 80  -j ACCEPT
iptables -A INPUT -p tcp --sport 443  -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT  
iptables -P INPUT DROP   # <<<<<<<<<<<<===== THIS LINE IS THE ONE THAT ACTUALLY BLOCKS THE OUTGOING HTTP REQUESTS !!!!
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

Here's the output of iptables -n -L :

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:443
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
1
  • What makes you think it has anything to do with the firewall? Oct 30, 2012 at 13:32

1 Answer 1

0

Try to add this

iptables -A INPUT -p tcp --sport 80 -j ACCEPT

Also, you might want to start whit iptables -P INPUT DROP

Also don't forget to set NAT translation, to open the port 53 for DNS request (it use both UDP and TCP).

If you accept all connection, are you able to access internet ? Try accessing using a IP adress.

Don't forget that HTTP request has to go in both direction

2
  • 1
    First of all, thanks for your reply.. 1. If you'll look carefully you'll notice I already have "iptables -A INPUT -p tcp --sport 80 -j ACCEPT" in the above list of rules. 2. If I'll put "iptables -P INPUT DROP" at the beginning, I'll be locked out of my server - I've mentioned that it's a remote server which is connected through SSH 3. As for openning port 53... not needed because the following rule is already taking care of this: iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    – Don
    Oct 30, 2012 at 18:23
  • 4) if I type "iptables -P INPUT ACCEPT", I can access remote sites without any problem.
    – Don
    Oct 30, 2012 at 18:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .