Question

I want to setup a firewall with iptables but it keeps blocking things I don't want blocked :(

After I add my exceptions and do:
iptables -A INPUT -j DROP

I can't run:
curl www.whatismyip.com/automation/n09230945.asp
curl www.whatismyip.com

I added all the ips and nameservers listed by whois for whatismyip.com:

iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT

Found from: http://cqcounter.com/whois/

Answer 1

Some things to check:

• Are you blocking DNS? Simply unblocking whatismyip.com's nameservers is not enough; to find out what nameservers www.whatismyip.com is using, your machine will need to go through at least one other nameserver.
• Does anything in your OUTPUT policy prevent you from accessing that site?

Also, for debugging I recommend you to add -j LOG immediately in front of every -j DROP; that way, you can look in the system log to see what is getting dropped.

Answer 2

I'd suggest using the statefull inspection of iptables. By adding this rule

iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

the DNS server and the webserver of the page you called can send you responses to your requests.

Of cause you have to allow DNS and HTTP requests on the OUTPUT chain.

Answer 3

Following are IPs for the name www.whatismytrip.com

72.233.89.198 72.233.89.199 72.233.89.200

1) As "tetromino" suggested, check your DNS settings. See if the name is getting resolved or not.

2) You are using -A option to append rules at the end of the INPUT chain. Use iptables -L to check that the default drop-all rule is the last one.

3) You will have to add rules in OUTPUT chain as well, for all the IPs it resolves to.

iptables -A OUTPUT -d 72.233.89.198 -j ACCEPT