Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have wrote my rules like this:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A OUTPUT -i eth0 -p tcp --dport 80 -j ACCEPT

What do I do next?

share|improve this question

migrated from stackoverflow.com Mar 14 '10 at 0:45

This question came from our site for professional and enthusiast programmers.

2 Answers 2

After you apply the rules that heikogerlach showed you, here's a useful link to help you in the future so you understand what you're doing.

Basically, to answer the question you posed in a comment, you need this rule:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

so that incoming packets that are a response to a packet sent by your system will be allowed in. Otherwise this box won't be able to receive anything except to port 80.

NOTE: You also have to tell us something additional ... Do you want to block all access except incoming and outgoing web, or only incoming or only outgoing? What traffic do you want to allow?

share|improve this answer

Now you are allowed to send packets from your computer to another one with the destination port 80. You must allow responses from the remote computers and you want to receive errors, too.

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT

You need the kernel module ip_conntrack for connection tracking:

modprobe ip_conntrack
share|improve this answer
    
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT Why this rule is needed? –  toddoon Mar 18 '09 at 15:36
    
This rule means that any traffic, especially incoming traffic, is allowed that belongs to the connection you opened. Otherwise you would not allow any data to come back. –  unbeknown Mar 18 '09 at 15:44
    
And you probably want to allow traffic from localhost/127.0.0.1 unless you don't care about all kinds of stuff stopping to work. –  unbeknown Mar 18 '09 at 15:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.