Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to set minimal rules to my Linux iptables rules file to just be able to surf the internet.

Here what I did:

* filter

-A OUTPUT -p tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp --dport 443 -j ACCEPT
-A OUTPUT -p udp --dport 53 -j ACCEPT

COMMIT

With just those rules, I can't surf the web.

I noticed that when I put -A INPUT -j ACCEPT, it works but I don't understand why. So what Input/output port do I need to surf the internet?

Thanks a lot. Regards

EDIT: It still doesn't work.

here is my iptables -L

Chain INPUT (policy DROP)
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

Chain FORWARD (policy DROP)
blank

Chain OUTPUT (Policy ACCEPT)
ACCEPT all -- anywhere anywhere

However, if I add -A INPUT -j ACCEPT, I can surf the internet. So there should be something else within INPUT that's preventing it.

share|improve this question

closed as off-topic by Jenny D, mdpc, Falcon Momot, kce, John Oct 4 '13 at 19:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is a site dedicated to professionals; novice questions are off-topic. Please see the Help Center for more information on topicality. The best advice we can give you is to hire a professional to help you out." – Jenny D, mdpc, Falcon Momot, John
If this question can be reworded to fit the rules in the help center, please edit the question.

    
Does it still not work, now that you have changed "ACCEPTED" to "ACCEPT"? –  Skyhawk Jun 5 '12 at 17:18
    
Hi, I just edited the bottom of my post with the iptables -L. Thanks. Regards –  alexx0186 Jun 5 '12 at 18:20
    
You technically needn't set any at all (nor drop policies). Nonetheless, I fear this is off topic here, as it doesn't appear to be about professional system administration. –  Falcon Momot Oct 4 '13 at 2:51
add comment

3 Answers 3

up vote 10 down vote accepted

You need to allow traffic that's returning from the remote servers, as well. Your input chain needs to allow those responses; the connection state module can make sure those responses are allowed.

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
share|improve this answer
    
Hi, thanks for your response. I tried your way. It seems to have worked for a few seconds, then I still get the same problem. I used iptables-save to extract the rules as they appear. I put them at the end of my post. Thanks a lot if you could tell me what is wrong. Regards –  alexx0186 Jun 5 '12 at 4:16
    
@alexx0186 I'm not seeing your rules in the OUTPUT chain anymore? Those are still needed in order for the connection to be allowed in the first place. –  Shane Madden Jun 5 '12 at 4:33
    
Oh ok. Is there a reason why -P OUTPUT ACCEPT is not enough? I thought that I wouldn't need those OUTPUT rules, if I accept all OUTPUT packets. Thanks. –  alexx0186 Jun 5 '12 at 5:13
    
@alexx0186 Oh, yes - I didn't notice that you'd changed that; that should work fine. Though now that I look closer your new rule set says -j ACCEPTED instead of -j ACCEPT; typo? –  Shane Madden Jun 5 '12 at 5:19
    
Hi, sorry it was just a typo on my post. There seems to be something else as INPUT that should be set in addition to the state RELATED,ESTABLISHED rule, because if I add -A INPUT -j ACCEPT as a rule, I can surf the internet. Thanks a lot for your help. Regards –  alexx0186 Jun 5 '12 at 18:09
add comment

Why exactly do you feel the need to regulate outbound connections?

The OUTPUT table manages OUTBOUND packets, and the INPUT table manages inbound packets.

If you're looking to secure your workstation/server, you should focus on INPUT rules and use a default 'DROP' rule and a 'RELATED,ESTABLISHED' rule like this one:

 /sbin/iptables -P INPUT DROP
 iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

This will allow you to then open additional specific ports while keeping most traffic out.

share|improve this answer
add comment

try to add this line in /etc/sysconfig/iptables (your IPtables rule file)

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Some time iptables-save didn't work for me,It shows that it is save by restarting iptables service returned it to previous stage

share|improve this answer
    
Hi Shariq, thanks for your answer. This question already has an almost identical answer to yours that was marked as being correct over a year ago. I'm also not seeing anything in this question to indicate that the OP is running a RedHat-derived system and hence even has an /etc/sysconfig/ directory. –  Ladadadada Oct 3 '13 at 14:50
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.