Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here is my firewall script for an internal development server. I want to be able to get out with http/https but I only want the server accessible via ssh/http from within the internal network.

iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables -A INPUT -i eth0 -p tcp -s 10.1.1.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 10.1.1.0/24 --dport http -j ACCEPT

Seems to work as I expected but for some reason I cannot get seem to access the outside world. For example:

super@dev0:~$ ping google.com
ping: unknown host google.com

Since I set my default OUTPUT policy to ACCEPT, shouldn't I be able to get out without any limits? What am I misunderstanding?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

You're not allowing related packets back in. What you're seeing is not just that ping doesn't work, but that you can't even resolve DNS names. You need to do a state match for ESTABLISHED and RELATED packets:

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

You might as well just allow ping inbound too:

iptables -I INPUT 2 -p icmp --icmp-type echo-request -j ACCEPT
share|improve this answer
    
Thank you James! That makes sense. (And it worked :) –  Aaron Lozier Feb 2 '12 at 19:51

pings use ICMP. Your rules with states are for TCP. The ICMP packets goes out of your network, but are blocked with your "INPUT DROP" default policie.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.