6

I have setup iptables this way:

Table: mangle
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

Table: filter
Chain INPUT (policy DROP)
num  target     prot opt source               destination
1    VZ_INPUT   all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP)
num  target     prot opt source               destination
1    VZ_FORWARD  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination
1    VZ_OUTPUT  all  --  0.0.0.0/0            0.0.0.0/0

Chain VZ_FORWARD (1 references)
num  target     prot opt source               destination

Chain VZ_INPUT (1 references)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  12.123.12.myip       0.0.0.0/0           tcp dpt:22
2    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:53
7    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:53
8    ACCEPT     tcp  --  127.0.0.1            127.0.0.1
9    ACCEPT     udp  --  127.0.0.1            127.0.0.1
13   ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255


Chain VZ_OUTPUT (1 references)
num  target     prot opt source               destination
1    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0
2    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0
3    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255
4    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:53
5    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:53

Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

I can ping hosts by IP, however I can not ping hosts by name neither do wget http://ipaddress/ from command line.

root ~ # ping google.com

root ~ # ping 89.33.254.54
PING 89.33.254.54 (89.33.254.54) 56(84) bytes of data.
64 bytes from 89.33.254.54: icmp_seq=1 ttl=54 time=82.2 ms

--- 89.33.254.54 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 82.263/82.263/82.263/0.000 ms
root ~ # wget http://89.33.254.50
--2011-12-09 17:21:03--  http://89.33.254.50/
Connecting to 89.33.254.50:80...

Why, if all the output traffic is allowed, I can't connect to remote hosts? I guess I have to open some more INPUT ports but what are those?

1
  • cat /etc/resolv.conf?
    – quanta
    Dec 9, 2011 at 15:35

1 Answer 1

16

I recommend you add rules to the INPUT chain which allows ESTABLISHED and RELATED packets:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 

If later you lock down your OUTPUT chain more, you are also going to want the corresponding OUTPUT rule:

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

These rules are safe, and you'll find that they are typically the among the first rules added in almost all firewall scripts. ESTABLISHED means "once I've allowed a connection to be established, let all the packets for this connection through" it doesn't allow otherwise disallowed connections to be created. "RELATED" allows useful packets like "Since I sent a request to start a connection, allow the ICMP packet back which tells me this host is not reachable" or "Since I allowed an ftp connection, also allow the ftp data connection". Again, it should not allow additional connections to be created which were not already allowed by other rules.

Right now you are allowing the DNS query to go out, but not the reply to come back. You are currently allowing dpt:53 which will allow someone to query your DNS server, but doesn't help with a DNS response (which you'd expect to have 53 for a source port, but not a dest port)

Another thing of note is that since your default policy of OUTPUT is ACCEPT, all your other rules are not useful (since they are all also ACCEPT). So you are essentially saying "if the packet is one of the following types of packets, then ACCEPT them, otherwise also ACCEPT them anyway", you could skip all the rules in this case and just say "Accept all outgoing packets" It sounds like, however, this is temporary until you get DNS traffic working better.

1
  • +1. had this problem. the first rule did it for me. Thanks! huge time saver!
    – thang
    Aug 20, 2019 at 23:34

You must log in to answer this question.