Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to set up some firewall rules for allowing SSH, incoming ping, munin, and MySQL between one server and another (all those services are working fine with my rules), but when I apply the rules, I can no longer ping or resolve any DNS (so I can ping 74.125.225.65 but not google.com).

Here are the rules I'm using:

# Accept traffic on localhost:
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow SSH from anywhere:
iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

# Accept ICMP Ping requests (incoming and outgoing):
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT

# Allow munin from subdomain.example.com:
iptables -I INPUT -p tcp -s 123.23.45.1 --dport 4949 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -I OUTPUT -p tcp -d 123.23.45.1 --dport 4949 -m state --state ESTABLISHED -j ACCEPT

# Allow MySQL from subdomain.example.com:
iptables -I INPUT 2 -p tcp -s 123.23.45.1 --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -d 123.23.45.1 --dport 3306 -j ACCEPT

# Drop all other traffic:
iptables -A INPUT -j DROP

resolv.conf, /etc/hosts, etc. are all correct, and if I simply do a $ iptables -F, and ping google again, it works fine. Only after the firewall rules are applied do I get ping: unknown host google.com.

share|improve this question
    
What is the current state of your firewall? And why are you using these strange OUTPUT rules? –  Michael Hampton Dec 14 '12 at 19:10
    
I don't have a drop rule after the output chain yet, but I also want to make sure that only certain things can leave the server as well... –  geerlingguy Dec 14 '12 at 19:23

1 Answer 1

up vote 1 down vote accepted

You have no rules to allow DNS traffic, so how could it work?

share|improve this answer
    
<facepalm> iptables -I INPUT -p udp -i eth0 --sport 53 -j ACCEPT </facepalm> –  geerlingguy Dec 14 '12 at 19:18
1  
Although it will probably work even if you don't, the standards say you need to allow outbound TCP connections to port 53 too (and, of course, the reply packets). A DNS reply can be too large to fit in a single UDP datagram. –  David Schwartz Dec 14 '12 at 19:27
    
Good to know - thanks! –  geerlingguy Dec 14 '12 at 19:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.