Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My standard policy on INPUT is set to DROP.

However, due to this setting I'm not able to connect to an external mailing host. What rule would I need to enable connecting to this external host.

Note that ping also doesn't work, though this is merely for testing purposes (it doesn't need to work, but may help in finding the root issue).\


[root@webshop ~]# iptables -L -v -n
Chain INPUT (policy DROP 150 packets, 18963 bytes)
 pkts bytes target     prot opt in     out     source               destination
 378K  178M ACCEPT     all  --  *      *       xxxxxxxxxxxxx
    0     0 DROP       tcp  --  *      *             tcp dpt:56988 state NEW recent: UPDATE seconds: 60 hit_count: 4 name: DEFAULT side: source
    0     0 ACCEPT     tcp  --  *      *             tcp dpt:56988
  628 42832 ACCEPT     tcp  --  *      *             multiport dports 8080,8181
 7682  765K ACCEPT     all  --  lo     *  

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  *      *             multiport dports 8080,8181

Chain OUTPUT (policy ACCEPT 933 packets, 616K bytes)
 pkts bytes target     prot opt in     out     source               destination
share|improve this question
Show the output of iptables -L -v -n – ALex_hha Jul 22 '13 at 9:25
@ALex_hha Done. xxxxxxxxxxxx represents my home IP which enables me to make use of JMX et cetera. – Aquillo Jul 22 '13 at 9:30
up vote 5 down vote accepted

Communication goes in two directions, you send queries to another host (via OUTPUT) and the other host responds (to INPUT). Your current rules cause all responses to get dropped. Try the adding the following rule in order to accept those responses:

-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Without this rule, TCP ACK packets, ICMP echo-reply, etc. get dropped because you have no rule allowing them.

share|improve this answer
Thank you very much! Working ;) – Aquillo Jul 22 '13 at 9:37
I personally recommend against including ,RELATED merely on a cargo-cult basis. It's not needed in order to solve this particular problem, and including it can open your firewall to all sorts of odd traffic depending on which kernel modules are loaded. – MadHatter Jul 22 '13 at 9:41
@MadHatter Thanks for the addition, I'll close whatever doesn't need to be open :) – Aquillo Jul 22 '13 at 9:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.