Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just want to surf the web and be a web server but it's not working.

My rules are:

-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP

-A INPUT -p tcp --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

Also, I am not quite sure about those states. Which ones are useless in my case, and why?

Thanks a lot for your help.

EDIT

I still can't surf the internet. With these rules, I want my server to be a web server and at the same time, be able to surf the internet from this machine (this is just for practice)

Here are my updated rules. What's wrong with them? (I added two lines for DNS port, not sure if they're useful or correct)

    -P INPUT DROP
    -P OUTPUT DROP
    -P FORWARD DROP

    -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    -I OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    -A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
    -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

    -A OUTPUT -p tcp --dport 53 -j ACCEPT
    -A INPUT -p tcp --dport 53 -j ACCEPT
share|improve this question
    
Vote to move - not a programming question –  Adrian Cornish Aug 24 '12 at 3:08
1  
Add a -A OUTPUT -j LOG at the end of the rules to see what's getting dropped. This will give you a hint as to what you're dropping that needs to pass. Especially if it's just for practice, since you will learn something that way. –  Celada Aug 24 '12 at 16:09
add comment

migrated from stackoverflow.com Aug 24 '12 at 16:22

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 2 down vote accepted

Your INPUT rule looks like it is trying to allow incoming connections to a web server on the local machine. Your OUTPUT rule looks like it is trying to allow outgoing connections from the local machine to any outside web server. Which are you trying to achieve? Both?

In any case, you will need to be more permissive about your ESTABLISHED,RELATED rules. You want to allow all of the packets that are part of established connections, not just the ones that have destination port 80. In particular, the replies from the web server don't have destination port 80 (they have source port 80) and you don't allow them. Typically, you would have a rule at the top of each chain that allows all established and related packets:

-I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-I OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Once you've done that, you can just permit the initial packet that forms a new connection. For allowing access to the local web server:

-A INPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

...and for allowing access from the local machine to outside web servers:

-A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

BUT for the second case (allowing access from the local machine to outside web servers), have you thought about whether that's what you really want? You want nothing else but HTTP to go through, not even DNS?

share|improve this answer
    
Hi, thanks for your response. I've edited original post with the updated rules. There is still something wrong on my side. Not sure what this is. Thanks a lot for your help –  ericd Aug 24 '12 at 14:30
1  
You'll probably also need to account for https on port 443, and it won't be long before you run into websites on non-standard ports - 1080, 8080, etc.... I typically find myself needing to allow a lot more outgoing connections than just ports 80 and 53... –  twalberg Aug 24 '12 at 15:58
    
Thanks a lot for your help. Regards –  ericd Aug 25 '12 at 1:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.