Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to setup a firewall with iptables but it keeps blocking things I don't want blocked :(

After I add my exceptions and do:
iptables -A INPUT -j DROP

I can't run:

I added all the ips and nameservers listed by whois for

iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT

Found from:

share|improve this question

migrated from Jul 24 '09 at 23:41

This question came from our site for professional and enthusiast programmers.

Those are all using the same IP: 72.233.195 - typo in posting only? – rexem Jul 24 '09 at 22:27
and of course, an ip address is 4x8 bits, so surely there's a mistake here – asdmin Jul 25 '09 at 8:52

Some things to check:

  • Are you blocking DNS? Simply unblocking's nameservers is not enough; to find out what nameservers is using, your machine will need to go through at least one other nameserver.
  • Does anything in your OUTPUT policy prevent you from accessing that site?

Also, for debugging I recommend you to add -j LOG immediately in front of every -j DROP; that way, you can look in the system log to see what is getting dropped.

share|improve this answer
I wondered the same thing. The full list of iptables rules and the output from curl would be very helpful – Matt Simmons Jul 25 '09 at 11:29

I'd suggest using the statefull inspection of iptables. By adding this rule

iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

the DNS server and the webserver of the page you called can send you responses to your requests.

Of cause you have to allow DNS and HTTP requests on the OUTPUT chain.

share|improve this answer

Following are IPs for the name

1) As "tetromino" suggested, check your DNS settings. See if the name is getting resolved or not.

2) You are using -A option to append rules at the end of the INPUT chain. Use iptables -L to check that the default drop-all rule is the last one.

3) You will have to add rules in OUTPUT chain as well, for all the IPs it resolves to.

iptables -A OUTPUT -d -j ACCEPT

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.