Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a virtual machine on debian. I have made some modification to the HN to allow statefull firewall inside vm (http://wiki.openvz.org/Setting_up_an_iptables_firewall).

Here is my firewall script :

# Flushing all rules
iptables -F
iptables -X

# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Allow unlimited traffic on loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow all related and established tcp connections to my_machine.
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

# Https In
iptables -A INPUT -p tcp -s 0/0 --sport 513:65535 --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

# Allow ping
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

# Allow incoming ssh only
iptables -A INPUT -p tcp -s 0/0 --sport 513:65535 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

# make sure nothing comes
iptables -A INPUT -j DROP

# Allow all outgoing connection
iptables -A OUTPUT -j ACCEPT

iptables -L

iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp spts:login:65535 dpt:https state NEW,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
ACCEPT     tcp  --  anywhere             anywhere            tcp spts:login:65535 dpt:ssh state NEW,ESTABLISHED
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

When I try to use fsockopen. It fails. Why ?

Thanks in advance

share|improve this question
    
I found in the log : unable to connect to xxx.xxxx.xxx:80 (php_network_getaddresses: getaddrinfo failed: Temporary failure in name resolution). Seems to be a dns problem –  hotips Dec 17 '10 at 11:01

1 Answer 1

up vote 0 down vote accepted

I add this rule and i worked fine :

# Allow DNS client request
iptables -A INPUT -p udp --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.