Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've configured firewall rules using iptables. Outbound packets are being blocked. It seems like outbound packets are enabled. Does the use of bonding change anything, or do I just have incomplete rules?

/sbin/iptables -A INPUT -i bond0 -j ACCEPT
/sbin/iptables -A OUTPUT -o bond0 -j ACCEPT
/sbin/iptables -A OUTPUT -o bond1 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -j DROP
/sbin/service iptables save
share|improve this question
    
1) Can you reformat it so it's easier to read (indent commands 4 spaces so they become a code block. 2) Does this work without the firewall (so we know it's not the bonding that's the problem?) 3) Can you show us iptables -nL OUTPUT (indent 4 spaces...) –  DerfK Oct 22 '10 at 2:54
    
1)Indented:/sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save –  IAPaddler Oct 23 '10 at 15:37
    
/sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save –  IAPaddler Oct 23 '10 at 15:38
    
1) Indented /sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save –  IAPaddler Oct 23 '10 at 15:41
    
@IAPaddler you're supposed to edit your question and indent all outputs, like what @Zoredache had done. That said, please post the output of iptables-save (again, edit your question!) –  pepoluan Aug 19 '11 at 12:49

1 Answer 1

Bonding does not make a difference.

If that is the complete rule set, then your problem isn't that you are blocking outbound packets. I suspect if you ran a capture on some device outside, you would see packets leaving your system, and you would even see replies.

The easiest way to fix this would be to simply use a couple stateful rules like these. They will permit your system to make outbound connections, and the connection tracking will permit the response to be accepted on the INPUT side.

/sbin/iptables -t filter -A OUTPUT -m state --state NEW\,ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A INPUT -m state --state ESTABLISHED -j ACCEPT
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.