up vote 0 down vote favorite
share [g+] share [fb]

I have a Linux server that's only running SSH and Apache. This is basically my iptables setup:

ACCEPT     udp  --  <isp dns server>     anywhere            udp spt:domain 
ACCEPT     udp  --  <isp dns server>     anywhere            udp spt:domain 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
DROP       all  --  anywhere             anywhere

The problem I'm having happens when my web application makes REST-based connections to places like Google and Yahoo. Their responses seems to come in on high ports (like 54000 - 56000). I implemented a log for iptables and it would spit out a line like this when I tried accessing Google's REST API:

Mar 28 16:12:42 host kernel: Dropped by firewall: IN=eth0 OUT= MAC=00:16:3e:00:08:2c:00:26:0a:27:0d:00:08:00 SRC=74.125.226.146 DST=184.107.162.194 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=39440 PROTO=TCP SPT=443 DPT=56461 WINDOW=5672 RES=0x00 ACK SYN URGP=0

Of course my rules prevent those packets from coming in. Can anyone recommend a course of action that allows me to accept these packets? Or am I missing something important here?

Thanks, Aaron

link|improve this question
feedback

1 Answer

up vote 0 down vote accepted

If I understand your question correctly, you might want to look into stateful firewall rules. Some info -> https://wiki.archlinux.org/index.php/Simple_Stateful_Firewall

link|improve this answer
Very good: this line helped -- iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -- but I'm still having issues with other services. For now at least, getting to Google works, but other things still don't. :-( – Aaron Vegh Mar 28 '11 at 20:58
@Aaron what's still not working? can you post the output of iptables-save? – pepoluan Mar 29 '11 at 14:24
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.