Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is my firewall script for an internal development server. I want to be able to get out with http/https but I only want the server accessible via ssh/http from within the internal network.

iptables -P INPUT DROP
iptables -F
iptables -A INPUT -i eth0 -p tcp -s --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s --dport http -j ACCEPT

Seems to work as I expected but for some reason I cannot get seem to access the outside world. For example:

super@dev0:~$ ping
ping: unknown host

Since I set my default OUTPUT policy to ACCEPT, shouldn't I be able to get out without any limits? What am I misunderstanding?

share|improve this question
up vote 2 down vote accepted

You're not allowing related packets back in. What you're seeing is not just that ping doesn't work, but that you can't even resolve DNS names. You need to do a state match for ESTABLISHED and RELATED packets:

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

You might as well just allow ping inbound too:

iptables -I INPUT 2 -p icmp --icmp-type echo-request -j ACCEPT
share|improve this answer
Thank you James! That makes sense. (And it worked :) – Aaron Lozier Feb 2 '12 at 19:51

pings use ICMP. Your rules with states are for TCP. The ICMP packets goes out of your network, but are blocked with your "INPUT DROP" default policie.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.