Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux server that's only running SSH and Apache. This is basically my iptables setup:

ACCEPT     udp  --  <isp dns server>     anywhere            udp spt:domain 
ACCEPT     udp  --  <isp dns server>     anywhere            udp spt:domain 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
DROP       all  --  anywhere             anywhere         

The problem I'm having happens when my web application makes REST-based connections to places like Google and Yahoo. Their responses seems to come in on high ports (like 54000 - 56000). I implemented a log for iptables and it would spit out a line like this when I tried accessing Google's REST API:

Mar 28 16:12:42 host kernel: Dropped by firewall: IN=eth0 OUT= MAC=00:16:3e:00:08:2c:00:26:0a:27:0d:00:08:00 SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=39440 PROTO=TCP SPT=443 DPT=56461 WINDOW=5672 RES=0x00 ACK SYN URGP=0

Of course my rules prevent those packets from coming in. Can anyone recommend a course of action that allows me to accept these packets? Or am I missing something important here?

Thanks, Aaron

share|improve this question
up vote 0 down vote accepted

If I understand your question correctly, you might want to look into stateful firewall rules. Some info ->

share|improve this answer
Very good: this line helped -- iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -- but I'm still having issues with other services. For now at least, getting to Google works, but other things still don't. :-( – Aaron Vegh Mar 28 '11 at 20:58
@Aaron what's still not working? can you post the output of iptables-save? – pepoluan Mar 29 '11 at 14:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.