Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to setup a firewall with iptables but it keeps blocking things I don't want blocked :(

After I add my exceptions and do:
iptables -A INPUT -j DROP

I can't run:
curl www.whatismyip.com/automation/n09230945.asp
curl www.whatismyip.com

I added all the ips and nameservers listed by whois for whatismyip.com:

iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT
iptables -A INPUT -s 72.233.195 -j ACCEPT

Found from: http://cqcounter.com/whois/

share|improve this question

migrated from stackoverflow.com Jul 24 '09 at 23:41

This question came from our site for professional and enthusiast programmers.

    
Those are all using the same IP: 72.233.195 - typo in posting only? –  rexem Jul 24 '09 at 22:27
    
and of course, an ip address is 4x8 bits, so surely there's a mistake here –  asdmin Jul 25 '09 at 8:52

3 Answers 3

Some things to check:

  • Are you blocking DNS? Simply unblocking whatismyip.com's nameservers is not enough; to find out what nameservers www.whatismyip.com is using, your machine will need to go through at least one other nameserver.
  • Does anything in your OUTPUT policy prevent you from accessing that site?

Also, for debugging I recommend you to add -j LOG immediately in front of every -j DROP; that way, you can look in the system log to see what is getting dropped.

share|improve this answer
    
I wondered the same thing. The full list of iptables rules and the output from curl would be very helpful –  Matt Simmons Jul 25 '09 at 11:29

I'd suggest using the statefull inspection of iptables. By adding this rule

iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

the DNS server and the webserver of the page you called can send you responses to your requests.

Of cause you have to allow DNS and HTTP requests on the OUTPUT chain.

share|improve this answer

Following are IPs for the name www.whatismytrip.com

72.233.89.198 72.233.89.199 72.233.89.200

1) As "tetromino" suggested, check your DNS settings. See if the name is getting resolved or not.

2) You are using -A option to append rules at the end of the INPUT chain. Use iptables -L to check that the default drop-all rule is the last one.

3) You will have to add rules in OUTPUT chain as well, for all the IPs it resolves to.

iptables -A OUTPUT -d 72.233.89.198 -j ACCEPT

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.