I have a server which has, up to this point, only been allowed to communicate with itself, other devices on the local network or, if communication is necessary to the outside world, the internet only through the VPN it is connected to (this would be tun below). The exception to this rule is allowing the server to connect to the VPN in the first place. All other traffic is not allowed!
Now, I'd like to add web hosting for a simple website application on the server. Anyone outside the local network should be allowed to see the website.
This is my IPTABLES so far.
Chain INPUT (policy DROP 36 packets, 16356 bytes) pkts bytes target prot opt in out source destination 46009 17M ACCEPT all -- lo any anywhere anywhere 1212K 87M ACCEPT all -- any any 192.168.0.0/24 anywhere 4294K 5952M ACCEPT all -- tun+ any anywhere anywhere 4366K 6246M ACCEPT udp -- any any anywhere anywhere udp spt:openvpn 313 18288 ACCEPT tcp -- any any anywhere anywhere tcp dpt:http state NEW,ESTABLISHED Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy DROP 137 packets, 39466 bytes) pkts bytes target prot opt in out source destination 46009 17M ACCEPT all -- any lo anywhere anywhere 3872K 5478M ACCEPT all -- any any anywhere 192.168.0.0/24 2078K 113M ACCEPT all -- any tun+ anywhere anywhere 2140K 260M ACCEPT udp -- any any anywhere anywhere udp dpt:openvpn 0 0 ACCEPT tcp -- any any anywhere anywhere tcp spt:http state ESTABLISHED
So I'm having problems with an outside device seeing the web page and to confirm all external port check tools have stated that port 80 is not open. I've checked my router and have confirmed that it is not the source of the problem, so I'm led to believe it is the servers IPTABLES.
Can you see anything out of place with my
Again, summary of expectations: 1) allow all loopback 2) allow all local 3) allow vpn to establish 4) allow vpn traffic 5) allow http hosting
EDIT: Yes, I believe you are all correct, I was a vague in my questioning. I was specifically trying to ask for a vetting of my IPTABLES configuration, specifically the port 80 chains, because I was under the impression that my IPTABLES were too restrictive and preventing my http server from delivering web pages on request. However, after DukeLion pointed me to logging iptables actions, I've confirmed that the problem is, at least for the moment, elsewhere.
This issue is done.