Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My standard policy on INPUT is set to DROP.

However, due to this setting I'm not able to connect to an external mailing host. What rule would I need to enable connecting to this external host.

Note that ping also doesn't work, though this is merely for testing purposes (it doesn't need to work, but may help in finding the root issue).\

Edit

[root@webshop ~]# iptables -L -v -n
Chain INPUT (policy DROP 150 packets, 18963 bytes)
 pkts bytes target     prot opt in     out     source               destination
 378K  178M ACCEPT     all  --  *      *       xxxxxxxxxxxxx        0.0.0.0/0
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:56988 state NEW recent: UPDATE seconds: 60 hit_count: 4 name: DEFAULT side: source
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:56988
  628 42832 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           multiport dports 8080,8181
 7682  765K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           multiport dports 8080,8181

Chain OUTPUT (policy ACCEPT 933 packets, 616K bytes)
 pkts bytes target     prot opt in     out     source               destination
share|improve this question
    
Show the output of iptables -L -v -n –  ALex_hha Jul 22 '13 at 9:25
    
@ALex_hha Done. xxxxxxxxxxxx represents my home IP which enables me to make use of JMX et cetera. –  Aquillo Jul 22 '13 at 9:30
add comment

1 Answer

up vote 5 down vote accepted

Communication goes in two directions, you send queries to another host (via OUTPUT) and the other host responds (to INPUT). Your current rules cause all responses to get dropped. Try the adding the following rule in order to accept those responses:

-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Without this rule, TCP ACK packets, ICMP echo-reply, etc. get dropped because you have no rule allowing them.

share|improve this answer
    
Thank you very much! Working ;) –  Aquillo Jul 22 '13 at 9:37
    
I personally recommend against including ,RELATED merely on a cargo-cult basis. It's not needed in order to solve this particular problem, and including it can open your firewall to all sorts of odd traffic depending on which kernel modules are loaded. –  MadHatter Jul 22 '13 at 9:41
    
@MadHatter Thanks for the addition, I'll close whatever doesn't need to be open :) –  Aquillo Jul 22 '13 at 9:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.