I have a Linux server that's only running SSH and Apache. This is basically my iptables setup:
ACCEPT udp -- <isp dns server> anywhere udp spt:domain ACCEPT udp -- <isp dns server> anywhere udp spt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:https DROP all -- anywhere anywhere
The problem I'm having happens when my web application makes REST-based connections to places like Google and Yahoo. Their responses seems to come in on high ports (like 54000 - 56000). I implemented a log for iptables and it would spit out a line like this when I tried accessing Google's REST API:
Mar 28 16:12:42 host kernel: Dropped by firewall: IN=eth0 OUT= MAC=00:16:3e:00:08:2c:00:26:0a:27:0d:00:08:00 SRC=220.127.116.11 DST=18.104.22.168 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=39440 PROTO=TCP SPT=443 DPT=56461 WINDOW=5672 RES=0x00 ACK SYN URGP=0
Of course my rules prevent those packets from coming in. Can anyone recommend a course of action that allows me to accept these packets? Or am I missing something important here?