Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've setup IPTables with the following script... however, I cannot get outgoing HTTP queries to work (I've tried using lynx & curl).

Background - server is hosted remotely (and I'm connecting via SSH).

Your help will be greatly appreciated...


Here's my iptables setup:

iptables -P INPUT ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # ssh
iptables -A INPUT -p tcp --dport 80 -j ACCEPT # http
iptables -A INPUT -p tcp --dport 443 -j ACCEPT # https
iptables -A INPUT -p tcp --sport 80  -j ACCEPT
iptables -A INPUT -p tcp --sport 443  -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT  
iptables -P INPUT DROP   # <<<<<<<<<<<<===== THIS LINE IS THE ONE THAT ACTUALLY BLOCKS THE OUTGOING HTTP REQUESTS !!!!
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

Here's the output of iptables -n -L :

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:443
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
share|improve this question

migrated from stackoverflow.com Oct 30 '12 at 0:05

This question came from our site for professional and enthusiast programmers.

    
What makes you think it has anything to do with the firewall? –  Michael Hampton Oct 30 '12 at 13:32

1 Answer 1

Try to add this

iptables -A INPUT -p tcp --sport 80 -j ACCEPT

Also, you might want to start whit iptables -P INPUT DROP

Also don't forget to set NAT translation, to open the port 53 for DNS request (it use both UDP and TCP).

If you accept all connection, are you able to access internet ? Try accessing using a IP adress.

Don't forget that HTTP request has to go in both direction

share|improve this answer
    
First of all, thanks for your reply.. 1. If you'll look carefully you'll notice I already have "iptables -A INPUT -p tcp --sport 80 -j ACCEPT" in the above list of rules. 2. If I'll put "iptables -P INPUT DROP" at the beginning, I'll be locked out of my server - I've mentioned that it's a remote server which is connected through SSH 3. As for openning port 53... not needed because the following rule is already taking care of this: iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT –  Don Oct 30 '12 at 18:23
    
4) if I type "iptables -P INPUT ACCEPT", I can access remote sites without any problem. –  Don Oct 30 '12 at 18:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.