I have setup iptables this way:
Table: mangle
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
Chain INPUT (policy ACCEPT)
num target prot opt source destination
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
Table: filter
Chain INPUT (policy DROP)
num target prot opt source destination
1 VZ_INPUT all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP)
num target prot opt source destination
1 VZ_FORWARD all -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
1 VZ_OUTPUT all -- 0.0.0.0/0 0.0.0.0/0
Chain VZ_FORWARD (1 references)
num target prot opt source destination
Chain VZ_INPUT (1 references)
num target prot opt source destination
1 ACCEPT tcp -- 12.123.12.myip 0.0.0.0/0 tcp dpt:22
2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
6 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
7 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53
8 ACCEPT tcp -- 127.0.0.1 127.0.0.1
9 ACCEPT udp -- 127.0.0.1 127.0.0.1
13 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255
Chain VZ_OUTPUT (1 references)
num target prot opt source destination
1 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0
2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0
3 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255
4 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 state NEW udp dpt:53
5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:53
Table: nat
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
I can ping hosts by IP, however I can not ping hosts by name neither do wget http://ipaddress/
from command line.
root ~ # ping google.com
root ~ # ping 89.33.254.54
PING 89.33.254.54 (89.33.254.54) 56(84) bytes of data.
64 bytes from 89.33.254.54: icmp_seq=1 ttl=54 time=82.2 ms
--- 89.33.254.54 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 82.263/82.263/82.263/0.000 ms
root ~ # wget http://89.33.254.50
--2011-12-09 17:21:03-- http://89.33.254.50/
Connecting to 89.33.254.50:80...
Why, if all the output traffic is allowed, I can't connect to remote hosts? I guess I have to open some more INPUT ports but what are those?
cat /etc/resolv.conf
?