1

Whith this rules I can't use wget to an external address or send emails through an external SMTP server:

#!/bin/bash

# Flush all current rules from iptables
iptables -F

# Allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Set access for localhost
iptables -A INPUT -i lo -j ACCEPT

# Accept packets belonging to established and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow incoming web traffic
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Save settings
/sbin/service iptables save

But if I add this, it works:

iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT
iptables -A INPUT -p tcp --sport 80 -j ACCEPT

Shouldn't the following rule allow any incoming connection originated by a previous request?

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

EDIT: when I run the script I get 2 errors:

iptables: Unknown error 4294967295
iptables: Unknown error 4294967295

I'm using CentOS 5.5 and iptables 1.3.5. Digging more I have found that there is a bug in this version: http://bugs.centos.org/view.php?id=3632 Can this be the cause of the problem?

EDIT 2: if I run demsg I get the same message repeated:

ip_tables: udp match: only valid for protocol 17

EDIT 3: Running iptables -L INPUT -v -n after a successfull wget shows:

# iptables -L INPUT -v -n
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   31  2020 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
    4   938 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:53
   12 11439 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:80

EDIT 4: Running sh -x script shows:

 # sh -x firewall.conf
+ iptables -F
+ iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+ iptables -P INPUT DROP
+ iptables -P FORWARD DROP
+ iptables -P OUTPUT ACCEPT
+ iptables -A INPUT -i lo -j ACCEPT
+ iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables: Unknown error 4294967295
+ iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables: Unknown error 4294967295
+ iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables: Unknown error 4294967295
+ iptables -A INPUT -p tcp --dport 80 -j ACCEPT
+ iptables -A INPUT -p tcp --dport 443 -j ACCEPT
+ /sbin/service iptables save
Saving firewall rules to /etc/sysconfig/iptables:          [  OK  ]
2
  • Show us what iptables-save displays. Also, what are your rules "Allow incoming web traffic" for? Do you have local WEB server?
    – poige
    Apr 1, 2011 at 4:58
  • Hi, when I run iptables-save I get the errors in the first edit of the question and yes, it is a web server.
    – SCL
    Apr 1, 2011 at 7:23

5 Answers 5

3

you dont have any rules in the OUTPUT chain and the default policy for it is DROP, so the initial tcp packets sent by your system when you try to open http or smtp connection get dropped. You need to add rules like these to permit outbound http and smtp for wget and email:

iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

iptables -A OUTPUT -p tcp --dport 25 -m state --state NEW -j ACCEPT

you can consolidate them into one rule using multiport:

iptables -A OUTPUT -p tcp -m multiport --dports 25,80 -m state --state NEW -j ACCEPT

7
  • Edit: nevermind.
    – Sean C.
    Mar 31, 2011 at 20:56
  • Hi vadimk, I have "iptables -P OUTPUT ACCEPT" so that should allow anything by default. I tried your suggestion but it still doesnt work.
    – SCL
    Mar 31, 2011 at 21:39
  • sorry, my mistake. Since wget works when you add rule that matches source port 80 (the one with -sport 80), then you should focus on the rule that should permit reply packets by matching their state ESTABLISHED. Either state is not created or the rule can not match it. I wonder which iptables command causes that strange error "Unknown error". TRy to run your iptables script like "sh -x script" to see which one it is. May be module "state" is not available on your system. Also to separate firewall and DNS problems try to run wget using ip address of the server instead of the name.
    – vadimk
    Apr 1, 2011 at 1:22
  • I run your test and it seems to be there the problem, as you said. So the only solution is to upgrade to a new version, as pepoluan suggests?
    – SCL
    Apr 1, 2011 at 7:10
  • looks like you have two choices: either upgrade iptables to get the fix for this bug or run it stateless with the rule that matches source port 80. The latter has security risks in that it is easy to initiate connection from outside with source port 80 to any port on your machine and this rule will permit it. This renders all other rules in the INPUT chain that protect your server rather useless.
    – vadimk
    Apr 1, 2011 at 17:40
1

Have you tried

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

It may be related to "state" module/kernel extension missing/having-issues/playing-mind-games (?).

May worth a try.

1
  • Hi jliendo, I tried but without luck. Thanks any way.
    – SCL
    Mar 31, 2011 at 21:52
1

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

This is only doing connection tracking on data crossing the input chain. Your connection isn't established yet, you're still doing a three way handshake (TCP three way handshake). So conntrack is denying the connection as it should.

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

should fix it.

19
  • Hi Sean, i tried but it still does not work with your rule.
    – SCL
    Mar 31, 2011 at 21:51
  • Based on your addition of ip_tables: udp match: only valid for protocol 17 I think there is a problem with the udp traffic coming back in. For diagnostics, add this iptables -A INPUT -p udp -j ACCEPT temporarily and see if it fixes the problem.
    – Sean C.
    Mar 31, 2011 at 23:07
  • Actually, as a further measure, run this command after you are successful with the wget. iptables -L INPUT -v -n That will give you counters to show which rules are being matched. Check to see which one is allowing the return traffic through the chain.
    – Sean C.
    Mar 31, 2011 at 23:10
  • 1
    @Sean no, you got that wrong. In conntrack, ESTABLISHED means a reply to an outgoing packet. conntrack's ESTABLISHED is different from TCP-Established state. This behavior enables conntrack to reat UDP replies as ESTABLISHED.
    – pepoluan
    Apr 1, 2011 at 3:08
  • Can you run this on a terminal, maybe in screen, while you attempt the wget? It will show conntrack states for all open connections... watch -n 0.5 "cat /proc/net/ip_conntrack" -- It may help diagnose this. @pepoluan; I stand corrected. When I learned this information, I was given information and took it at face value without confirming it myself. I'll be reading over the conntrack docs tomorrow. Thanks.
    – Sean C.
    Apr 1, 2011 at 3:14
1

I think you ought to update your iptables; mine's already version 1.4.10.

For instance, the 'Unknown error 4294967295' has been fixed in 1.3.6: http://ftp.netfilter.org/pub/iptables/changes-iptables-1.3.6.txt

Of course, this will very probably need a kernel update.

2
  • I did a complete yum update and still have the 1.3.5 version. It is the last version available from the repos. Is there another way to update it than building from source?
    – SCL
    Apr 1, 2011 at 11:09
  • Hmm... that's tough then. the 'tricky' part with iptables is that it's intimately tied to the netfilter code in the kernel. if the repo does not have a newer version, you have to build from source so that it 'adapts' to your kernel. I am not familiar with CentOS; does it have user-repos? If so, try searching for a newer iptables from them.
    – pepoluan
    Apr 2, 2011 at 1:55
0

You should "pair" the rules between INPUT and OUTPUT

Since outgoing wget is requesting to use port 21,80 and/or 443 TCP OUTPUT, and needs permission for "incoming INPUT" from sourceport 20,21,80 and/or 443 try this :

# rule OUT first :
iptables -A OUTPUT -p tcp -o ethX -d 0/0 -m multiport --dport 21,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT

# rule for "coming back" from OUT to INPUT :
iptables -A INPUT -p tcp -i ethX -s 0/0 -m multiport --sport 20,21,80,443 -m state --state ESTABLISHED -j ACCEPT

where ethX is your external eth interface (eth0 eth1 or whatever)

Rule for sending mails thru outer SMTP? Do the same, just change the dport and sport on each rule above

I hope that helps, it works for me.

Btw, My iptables is v1.3.5, and my default INPUT OUTPUT FORWARD policies set to DROP :-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .