Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to add this rule as the final, after all the other rules that allow the traffic.

iptables -A INPUT -j DROP

And this rule blocks everything.

When connecting through the web port 80, nginx throws "502 Bad Gateway". My guess that it somehow blocks some port like the database which causes the application not to respond?

Thanks.

share|improve this question
    
Perhaps you are setting this rule to a different interface? Look at iptables -L -v for more information. –  Belmin Fernandez Feb 29 '12 at 19:00
    
sorry I just edited the question, because it was badly formulated. –  valk Feb 29 '12 at 19:02
    
no, I allow everything like port 22, 80, 3000 etc, and adding this DROP rule as the last one. I ran nmap localhost, and basically allowed all the relevant ports from it's output. Possibly I'm blocking something on which the web app relies? –  valk Feb 29 '12 at 19:07
    
If that rule is blocking everything, then your rules to permit traffic are incomplete, broken, or wrong. We probably cannot do anything to help you without knowing more about the rest of your rules. –  Zoredache Feb 29 '12 at 19:08

2 Answers 2

up vote 5 down vote accepted

Think about adding iptables -A INPUT -i lo -j ACCEPT as first rule. Typically you can allow loopback connections without worsening security (but be aware of consequences).

share|improve this answer
    
+1, My bets are on relevant local traffic not being allowed. –  Aaron Copley Feb 29 '12 at 19:26
    
Thanks kupson, this was it :) –  valk Feb 29 '12 at 19:47
    
+1 - i wasn't even aware that loopback was handled by iptables - seems obvious now, but good thing to mention –  G. Bach Feb 29 '12 at 23:34

Additionally you could simply set the default policy of the chain if this is the only thing you want to accomplish:

iptables -P INPUT DROP

To answer your question though, no, iptables doesn't just decide 'not to work'. Your rules are probably wrong. If you update your question with the relevant information we can help you further.

share|improve this answer
    
gparent, thank you. –  valk Feb 29 '12 at 19:50
    
No problem, thanks for the vote if that was you :) I figured kupson was right since you mentioned the database, but I figured the comment would be helpful anyway :) –  gparent Feb 29 '12 at 19:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.