-1

I'm trying to configure an IPTables firewall on an apache webhost and I've come up with some rules that look like extending the chain that was already configured on the Centos box:

target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 
ACCEPT     icmp --  anywhere             anywhere            icmp any 
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns 
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pcsync-https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ndmp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:submission 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:10050 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

By whilst its allowing http connections to users who have been to the box before (existing connections, i guess) why is it refusing new connections?

As soon as the firewall is dropped all website stuff comes back just fine, so I don't get it.

Improve this question

1 Answer 1

Reset to default
1

It allows only specify new connection, i.e:

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:pop3 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp

It will allow new connection to port 80, 443, 110, 143, 25.

Improve this answer
1
  • But surely if i'm visting the website from a computer thats never been there before, that is a new connection? and they are being refused.
    – bugg_tb
    May 31, 2013 at 14:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .