Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server which has, up to this point, only been allowed to communicate with itself, other devices on the local network or, if communication is necessary to the outside world, the internet only through the VPN it is connected to (this would be tun below). The exception to this rule is allowing the server to connect to the VPN in the first place. All other traffic is not allowed!

Now, I'd like to add web hosting for a simple website application on the server. Anyone outside the local network should be allowed to see the website.

This is my IPTABLES so far.

Chain INPUT (policy DROP 36 packets, 16356 bytes)
 pkts bytes target     prot opt in     out     source               destination         
46009   17M ACCEPT     all  --  lo     any     anywhere             anywhere            
1212K   87M ACCEPT     all  --  any    any     192.168.0.0/24       anywhere            
4294K 5952M ACCEPT     all  --  tun+   any     anywhere             anywhere            
4366K 6246M ACCEPT     udp  --  any    any     anywhere             anywhere             udp spt:openvpn
  313 18288 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http state NEW,ESTABLISHED

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 137 packets, 39466 bytes)
 pkts bytes target     prot opt in     out     source               destination         
46009   17M ACCEPT     all  --  any    lo      anywhere             anywhere            
3872K 5478M ACCEPT     all  --  any    any     anywhere             192.168.0.0/24      
2078K  113M ACCEPT     all  --  any    tun+    anywhere             anywhere            
2140K  260M ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:openvpn
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:http state ESTABLISHED

So I'm having problems with an outside device seeing the web page and to confirm all external port check tools have stated that port 80 is not open. I've checked my router and have confirmed that it is not the source of the problem, so I'm led to believe it is the servers IPTABLES.

Can you see anything out of place with my iptables setup?

Again, summary of expectations: 1) allow all loopback 2) allow all local 3) allow vpn to establish 4) allow vpn traffic 5) allow http hosting

EDIT: Yes, I believe you are all correct, I was a vague in my questioning. I was specifically trying to ask for a vetting of my IPTABLES configuration, specifically the port 80 chains, because I was under the impression that my IPTABLES were too restrictive and preventing my http server from delivering web pages on request. However, after DukeLion pointed me to logging iptables actions, I've confirmed that the problem is, at least for the moment, elsewhere.

This issue is done.

share|improve this question

closed as unclear what you're asking by Falcon Momot, Ward, Lucas Kauffman, Stephane, Jenny D Jul 25 '13 at 9:03

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

up vote 0 down vote accepted

As a quick advice I can suggest you to add logging rule at the end of both input and output chains. It will allow you to actually see the blocked packets and have an idea of what should be permitted.

iptables -A INPUT -m limit --limit 10/min -j LOG --log-prefix "iptables drop: "
iptables -A OUTPUT -m limit --limit 10/min -j LOG --log-prefix "iptables drop: "
share|improve this answer
    
You helped me realize that this is not an IPTABLES issue; I have a problem somewhere else that is blocking port 80. Thank you! –  Patrick Bateman Jul 25 '13 at 19:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.