Iptables Webserver Connection Timeout

Question

After setting up iptables. My webserver has "connection timed out". I'm trying to setup my iptables based on what I have read is a pretty good starting point for a web server from another serverFault post. I have a file called "iptables-setup" with the following:

# Allow outgoing traffic and disallow any passthroughs

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# Allow traffic already established to continue

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow ssh, #dns, ftp and web services

iptables -A INPUT -p tcp --dport ssh -i eth0 -j ACCEPT
# DNS
# iptables -A INPUT -p tcp --dport domain -i eth0 -j ACCEPT
iptables -A INPUT -p tcp --dport ftp -i eth0 -j ACCEPT
iptables -A INPUT -p udp --dport ftp -i eth0 -j ACCEPT
iptables -A INPUT -p tcp --dport ftp-data -i eth0 -j ACCEPT
iptables -A INPUT -p udp --dport ftp-data -i eth0 -j ACCEPT
# HTTP
iptables -A INPUT -p tcp --dport 80 -i eth0 -j ACCEPT
# HTTPS
iptables -A INPUT -p tcp --dport 443 -i eth0 -j ACCEPT
# CPanel
iptables -A INPUT -p tcp --dport 2083 -i eth0 -j ACCEPT
# WHM
iptables -A INPUT -p tcp --dport 2087 -i eth0 -j ACCEPT

# Allow local loopback services

iptables -A INPUT -i lo -j ACCEPT

# Allow pings

iptables -I INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -I INPUT -p icmp --icmp-type source-quench -j ACCEPT
iptables -I INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -I INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -I INPUT -p icmp --icmp-type echo-reply -j ACCEPT

I then run:

% service iptables stop
Flushing firewall rules: [  OK  ]
Setting chains to policy ACCEPT: mangle filter [  OK  ]
Unloading iptables modules: [  OK  ]

% sh iptables-setup 

% service iptables save
Saving firewall rules to /etc/sysconfig/iptables: [  OK  ]

% service iptables restart
Flushing firewall rules: [  OK  ]
Setting chains to policy ACCEPT: mangle filter [  OK  ]
Unloading iptables modules: [  OK  ]
Applying iptables firewall rules: [  OK  ]

% iptables --list -n -v
Chain INPUT (policy ACCEPT 84670 packets, 33M bytes)
 pkts bytes target     prot opt in     out     source               destination         
84083   33M acctboth   all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 110K packets, 52M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 109K   52M acctboth   all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain acctboth (2 references)
 pkts bytes target     prot opt in     out     source               destination         
  116 16979            tcp  --  !lo    *       [MY_IP]        0.0.0.0/0           tcp dpt:80 
   78  158K            tcp  --  !lo    *       0.0.0.0/0            [MY_IP]       tcp spt:80 
    0     0            tcp  --  !lo    *       [MY_IP]        0.0.0.0/0           tcp dpt:25 
    0     0            tcp  --  !lo    *       0.0.0.0/0            [MY_IP]       tcp spt:25 
    0     0            tcp  --  !lo    *       [MY_IP]        0.0.0.0/0           tcp dpt:110 
    0     0            tcp  --  !lo    *       0.0.0.0/0            [MY_IP]       tcp spt:110 
    5   866            icmp --  !lo    *       [MY_IP]        0.0.0.0/0           
    3   132            icmp --  !lo    *       0.0.0.0/0            [MY_IP]       
26431   11M            tcp  --  !lo    *       [MY_IP]        0.0.0.0/0           
19622 7514K            tcp  --  !lo    *       0.0.0.0/0            [MY_IP]       
   64  4250            udp  --  !lo    *       [MY_IP]        0.0.0.0/0           
   66 10580            udp  --  !lo    *       0.0.0.0/0            [MY_IP]       
26500   11M            all  --  !lo    *       [MY_IP]        0.0.0.0/0           
19691 7524K            all  --  !lo    *       0.0.0.0/0            [MY_IP]       
    0     0            tcp  --  !lo    *       [MY_IP]        0.0.0.0/0           tcp dpt:80 
    0     0            tcp  --  !lo    *       0.0.0.0/0            [MY_IP]       tcp spt:80 
    0     0            tcp  --  !lo    *       [MY_IP]        0.0.0.0/0           tcp dpt:25 
    0     0            tcp  --  !lo    *       0.0.0.0/0            [MY_IP]       tcp spt:25 
    0     0            tcp  --  !lo    *       [MY_IP]        0.0.0.0/0           tcp dpt:110 
    0     0            tcp  --  !lo    *       0.0.0.0/0            [MY_IP]       tcp spt:110 
    1   576            icmp --  !lo    *       [MY_IP]        0.0.0.0/0           
    0     0            icmp --  !lo    *       0.0.0.0/0            [MY_IP]       
   15   600            tcp  --  !lo    *       [MY_IP]        0.0.0.0/0           
   17   720            tcp  --  !lo    *       0.0.0.0/0            [MY_IP]       
    0     0            udp  --  !lo    *       [MY_IP]        0.0.0.0/0           
    1  1016            udp  --  !lo    *       0.0.0.0/0            [MY_IP]       
   16  1176            all  --  !lo    *       [MY_IP]        0.0.0.0/0           
   18  1736            all  --  !lo    *       0.0.0.0/0            [MY_IP]       
47158   19M            all  --  !lo    *       0.0.0.0/0            0.0.0.0/0

% netstat -lntp | egrep ":80"
tcp        0      0 0.0.0.0:80                  0.0.0.0:*                   LISTEN      13687/httpd  

I added spaces for legibility and [MY_IP] is subbed in for my ip. Again, the question I have is, are there problems with my ipconfig that could be causing my web server to fail an HTTP connection that worked before?

Answer 1

You might want to show the output of iptables --list -n -v to get the full firewall rules bindings (including the interfaces and modules loaded)

Then included the output of netstat -lntp as you want to confirm that httpd is indeed listening on port 0.0.0.0:80 and not 127.0.0.1, for example

# netstat -lntp | egrep ":80"

tcp        0      0 :::80         :::*       LISTEN      1954/httpd

---

Edit: response to the iptables -v --list -n output...

Assuming that all the lines with missing protocols or "all" are for icmp and DENY rules, the only lines you have that match port 80 HTTP are the following;

116 16979   tcp  --  !lo    *  [MY_IP]        0.0.0.0/0       tcp dpt:80 
 78  158K   tcp  --  !lo    *   0.0.0.0/0     [MY_IP]         tcp spt:80    
  0     0   tcp  --  !lo    *   [MY_IP]        0.0.0.0/0      tcp dpt:80 
  0     0  tcp  --  !lo    *    0.0.0.0/0      [MY_IP]        tcp spt:80 

I think that the destination port is mixed up with the source port. For your incoming traffic to the HTTP port (the rows with "tcp dpt:80" ) then the left column should be WAN addresses (0.0.0.0/0) and the destination should have your own IP;

  116 16979   tcp  --  !lo    *       [MY_IP]    0.0.0.0/0           tcp dpt:80 

It should look like this instead;

  116 16979   tcp  --  !lo    *           0.0.0.0/0    [MY_IP]      tcp dpt:80 

---

Another Update::

with regard to your original script to create the rules, I don't see how the output is connected to the inputs, as your input script adds a general rule to allow all traffic on port 80 like so;

iptables -A INPUT -p tcp --dport 80 -i eth0 -j ACCEPT

However the rules in your output use a different strategy with a common chain called "acctboth" which has been inserted into both the INPUT and OUTPUT chains.

I would check that you are loading the correct configuration file.

A quick google indicates that the script you have pasted in, the one with the acctboth chain is actually a cpanel provided iptables rule set for bandwidth monitoring;

http://forums.cpanel.net/f5/iptables-acctboth-chain-74575.html

which explains all the crazy !lo and other stuff that doesn't match your inputs.... Basically reloading your rules is ignoring your ruleset, this is probably due to whatever has installed that "acctboth" bandwidth monitoring chain instead.