Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Server: Ubuntu Server 10.04 LTS

I have my iptables locked down so only ssh and http traffic is allowed in. Im trying to tunnel sql example: ssh -L 3306:127.0.0.1:3306 my@domain.com it works fine if I set my INPUT to ALLOW but as you can see below its set to drop so my ports are blocked. I asume its just a rule I need to add but everything I found on google has failed. Ideas?

iptables.up.rules

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [57:4388]
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
COMMIT

terminal output

xxx@xxx:/etc# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www
ACCEPT     icmp --  anywhere             anywhere            icmp any

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
share|improve this question

1 Answer 1

up vote 4 down vote accepted

You need to allow packets to arrive via loopback:

-A INPUT -i lo -j ACCEPT

You can tighten up the rule somewhat by ensuring that packets arriving via loopback also have the loopback address:

-A INPUT -d 127.0.0.1/32 -i lo -j ACCEPT
share|improve this answer
    
perfect, that did the trick. you sir are awesome. –  Ryan Mills Oct 6 '11 at 23:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.