iptables misconfiguration is blocking outgoing connections

Question

Here are the rules I setup..

iptables -P INPUT DROP
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT

When I try to make an outgoing connection, it gets blocked.

What's missing?

---

Here's the output from iptables -n -L

    Chain INPUT (policy DROP)
target     prot opt source               destination         
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           source IP range 93.0.0.0-93.255.255.255 
           tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 state NEW recent: SET name: DEFAULT side: source 
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 state NEW recent: UPDATE seconds: 60 hit_count: 15 name: DEFAULT side: source 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Note.. the first rule is there to block a particular range and the next two are supposed to limit the number of requests anyone can make within 60 seconds.

Answer 1

I don't see any rules that would allow an outgoing connection. Why do you think it should work? Perhaps you're missing the fact that if you make an outgoing connection to port 80, the return packets are from port 80, not to port 80.

If you want to make connection to port 80, you have two ways to let the return packets in:

1) Allow in packets from port 80.

2) Allow in packets that are part of an existing session.

I don't see any evidence you did either of these things.

Answer 2

To elaborate a bit on David's answer, you can allow in packets that are part of an existing session by adding the following rule to your filter table:

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Permitting input packets in the ESTABLISHED state will allow most all outgoing connections to work as you expect, including non-TCP "connectionless" stuff, such as DNS queries (UDP) and pings (ICMP).

Permitting input packets in the RELATED state enables you to receive ICMP error messages that may come back from connection attempts to administratively prohibited ports/hosts/networks and such.