Cannot ping outside network with these IP rules

Question

Here is my firewall script for an internal development server. I want to be able to get out with http/https but I only want the server accessible via ssh/http from within the internal network.

iptables -P INPUT DROP
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -F
iptables -A INPUT -i eth0 -p tcp -s 10.1.1.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s 10.1.1.0/24 --dport http -j ACCEPT

Seems to work as I expected but for some reason I cannot get seem to access the outside world. For example:

super@dev0:~$ ping google.com
ping: unknown host google.com

Since I set my default OUTPUT policy to ACCEPT, shouldn't I be able to get out without any limits? What am I misunderstanding?

Answer 1

You're not allowing related packets back in. What you're seeing is not just that ping doesn't work, but that you can't even resolve DNS names. You need to do a state match for ESTABLISHED and RELATED packets:

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

You might as well just allow ping inbound too:

iptables -I INPUT 2 -p icmp --icmp-type echo-request -j ACCEPT

Answer 2

pings use ICMP. Your rules with states are for TCP. The ICMP packets goes out of your network, but are blocked with your "INPUT DROP" default policie.