1

I am trying to set minimal rules to my Linux iptables rules file to just be able to surf the internet.

Here what I did:

* filter

-A OUTPUT -p tcp --dport 80 -j ACCEPT
-A OUTPUT -p tcp --dport 443 -j ACCEPT
-A OUTPUT -p udp --dport 53 -j ACCEPT

COMMIT

With just those rules, I can't surf the web.

I noticed that when I put -A INPUT -j ACCEPT, it works but I don't understand why. So what Input/output port do I need to surf the internet?

Thanks a lot. Regards

EDIT: It still doesn't work.

here is my iptables -L

Chain INPUT (policy DROP)
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

Chain FORWARD (policy DROP)
blank

Chain OUTPUT (Policy ACCEPT)
ACCEPT all -- anywhere anywhere

However, if I add -A INPUT -j ACCEPT, I can surf the internet. So there should be something else within INPUT that's preventing it.

3
  • Does it still not work, now that you have changed "ACCEPTED" to "ACCEPT"?
    – Skyhawk
    Jun 5, 2012 at 17:18
  • Hi, I just edited the bottom of my post with the iptables -L. Thanks. Regards
    – alexx0186
    Jun 5, 2012 at 18:20
  • You technically needn't set any at all (nor drop policies). Nonetheless, I fear this is off topic here, as it doesn't appear to be about professional system administration. Oct 4, 2013 at 2:51

3 Answers 3

13

You need to allow traffic that's returning from the remote servers, as well. Your input chain needs to allow those responses; the connection state module can make sure those responses are allowed.

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
5
  • Hi, thanks for your response. I tried your way. It seems to have worked for a few seconds, then I still get the same problem. I used iptables-save to extract the rules as they appear. I put them at the end of my post. Thanks a lot if you could tell me what is wrong. Regards
    – alexx0186
    Jun 5, 2012 at 4:16
  • @alexx0186 I'm not seeing your rules in the OUTPUT chain anymore? Those are still needed in order for the connection to be allowed in the first place. Jun 5, 2012 at 4:33
  • Oh ok. Is there a reason why -P OUTPUT ACCEPT is not enough? I thought that I wouldn't need those OUTPUT rules, if I accept all OUTPUT packets. Thanks.
    – alexx0186
    Jun 5, 2012 at 5:13
  • @alexx0186 Oh, yes - I didn't notice that you'd changed that; that should work fine. Though now that I look closer your new rule set says -j ACCEPTED instead of -j ACCEPT; typo? Jun 5, 2012 at 5:19
  • Hi, sorry it was just a typo on my post. There seems to be something else as INPUT that should be set in addition to the state RELATED,ESTABLISHED rule, because if I add -A INPUT -j ACCEPT as a rule, I can surf the internet. Thanks a lot for your help. Regards
    – alexx0186
    Jun 5, 2012 at 18:09
5

Why exactly do you feel the need to regulate outbound connections?

The OUTPUT table manages OUTBOUND packets, and the INPUT table manages inbound packets.

If you're looking to secure your workstation/server, you should focus on INPUT rules and use a default 'DROP' rule and a 'RELATED,ESTABLISHED' rule like this one:

 /sbin/iptables -P INPUT DROP
 iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

This will allow you to then open additional specific ports while keeping most traffic out.

0

try to add this line in /etc/sysconfig/iptables (your IPtables rule file)

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Some time iptables-save didn't work for me,It shows that it is save by restarting iptables service returned it to previous stage

1
  • Hi Shariq, thanks for your answer. This question already has an almost identical answer to yours that was marked as being correct over a year ago. I'm also not seeing anything in this question to indicate that the OP is running a RedHat-derived system and hence even has an /etc/sysconfig/ directory.
    – Ladadadada
    Oct 3, 2013 at 14:50

Not the answer you're looking for? Browse other questions tagged .