up vote 1 down vote favorite
share [g+] share [fb]

I've configured firewall rules using iptables. Outbound packets are being blocked. It seems like outbound packets are enabled. Does the use of bonding change anything, or do I just have incomplete rules?

/sbin/iptables -A INPUT -i bond0 -j ACCEPT
/sbin/iptables -A OUTPUT -o bond0 -j ACCEPT
/sbin/iptables -A OUTPUT -o bond1 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -j DROP
/sbin/service iptables save
link|improve this question
1) Can you reformat it so it's easier to read (indent commands 4 spaces so they become a code block. 2) Does this work without the firewall (so we know it's not the bonding that's the problem?) 3) Can you show us iptables -nL OUTPUT (indent 4 spaces...) – DerfK Oct 22 '10 at 2:54
1)Indented:/sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save – IAPaddler Oct 23 '10 at 15:37
/sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save – IAPaddler Oct 23 '10 at 15:38
1) Indented /sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save – IAPaddler Oct 23 '10 at 15:41
@IAPaddler you're supposed to edit your question and indent all outputs, like what @Zoredache had done. That said, please post the output of iptables-save (again, edit your question!) – pepoluan Aug 19 '11 at 12:49
feedback

1 Answer

up vote 1 down vote

Bonding does not make a difference.

If that is the complete rule set, then your problem isn't that you are blocking outbound packets. I suspect if you ran a capture on some device outside, you would see packets leaving your system, and you would even see replies.

The easiest way to fix this would be to simply use a couple stateful rules like these. They will permit your system to make outbound connections, and the connection tracking will permit the response to be accepted on the INPUT side.

/sbin/iptables -t filter -A OUTPUT -m state --state NEW\,ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A INPUT -m state --state ESTABLISHED -j ACCEPT
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.