Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was configuring a server, and I tried instituting what I thought were some pretty simple iptables rules:

[root host ~]
- iptables -L 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

[root host ~] 
- iptables -P INPUT DROP

Which resulted in the hanging of my SSH session. Now I can't access the machine by SSH at all, but all the other allowances (HTTP etc.) seem to be working fine.

I did a little more research after the fact, but this still looks like a correct configuration to me.

It seems to me that I've misunderstood the stated filtering iptables offers. Is that so? What's wrong with this picture?

EDIT: I adapted my rules from the debian iptables article, so you can see the original input lines there.

DOUBLE EDIT: I should be doing the leg work here; I've recreated the original inputs from the Debian article

-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
share|improve this question
1  
The iptables -L output can be incomplete. For example, it omits interface information. Can you post iptables-save output, too? –  anderbubble Jul 9 '12 at 11:44
    
Apparently you can also get verbose output out of iptables with iptables -Lv. –  anderbubble Jul 9 '12 at 11:57
    
I usually do use -L -v for exactly that reason, but the same poor planning that has me locked out also keeps me from accessing the detailed data. You'll have to take my word that topmost INPUT rule has -i lo, and the second has ! -i lo, and none of the others have any interface references at all. –  Michael Shick Jul 9 '12 at 12:07
    
Actually, you can see the original input lines in the link I added to my question. –  Michael Shick Jul 9 '12 at 12:14
    
Add -v to your iptables command to get complete information. Also consider using -n (numeric) to prevent any unnecessary DNS lookups. –  Michael Hampton Jul 10 '12 at 4:20

2 Answers 2

This rule is quite suspicious:

REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable

Unless you've made sure it doesn't apply to the loopback interface (lo) it'll probably break all sorts of stuff.

share|improve this answer
    
I would imagine so, but the rule is for all interfaces but loopback. The symptom is hanging connections, so given that this is REJECT, I'd expect it to have a more immediate effect. –  Michael Shick Jul 9 '12 at 12:05
up vote 0 down vote accepted

It turns out the problem was my second rule:

-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT

I foolishly didn't double-check the interfaces on the VPS, and since it's OpenVZ based, an internal vm interface had the address 127.0.0.2 but wasn't technically loopback which tripped this rule.

EDIT: Nope; I'm wrong again! It turned out finally to actually be that my VPS allowed insertion of state based rules but never matched them, so established connections were getting dropped when I set the policy to DROP.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.