Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With the following iptable rules, I was unable to do an apt update and ping a website. Whats wrong with the rules? How to fix it? What is the exact rule to fix it?

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:325 
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 
share|improve this question
Remember, IPTables works on PACKETS and not Logical Connections. Every last packet except TCP port 325 is getting dropped from the incoming traffic. – Magellan Nov 9 '12 at 4:15
Outgoing HTTP and HTTPS traffic is unblocked. The problem is that no rule lets the reply packets in. You probably want ESTABLISHED/RELATED rules. – David Schwartz Nov 9 '12 at 5:25
@DavidSchwartz Can you please tell me how to do it? – THpubs Nov 9 '12 at 5:30
Check out any iptables HOWTO or FAQ. For example, check out this page, specifically the rule to allow outgoing HTTPS and DNS. (Or do you want to allow all outbound connections to just work? If so, generate a similar rule for all ports, TCP and UDP.) – David Schwartz Nov 9 '12 at 5:31
up vote 1 down vote accepted

Get rid of the DROP rule in the INPUT chain. It's dropping virtually all traffic coming in to the machine, including responses to any traffic you send out.

share|improve this answer
Then how to block un-needed incoming traffic? The default policy to drop? – THpubs Nov 9 '12 at 4:16
That's a completely different question. :) – Michael Hampton Nov 9 '12 at 4:17
Michael: the perfect "you're in a balloon" answer. Upvote! – MadHatter Nov 9 '12 at 7:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.