Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP.

I have the code below;

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere             udp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere             udp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
DROP       tcp  --  anywhere             anywhere            
DROP       udp  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     udp  --  anywhere             anywhere             udp dpt:https
ACCEPT     udp  --  anywhere             anywhere             udp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
DROP       tcp  --  anywhere             anywhere            
DROP       udp  --  anywhere             anywhere            

.

Apparently this blocks just about every webpage I try to browse, doesn't matter whether it's http://example.com or https://example.com

What do I not get? Many thanks for your help!

share|improve this question
    
You need to be much more precise about what you mean by "blocks just about every webpage", but the way you're not allowing any DNS through suggests that it might be because you've also blocked all name resolution. –  MadHatter Jul 8 at 20:39
    
Hi thanks! After I posted this I learned that by adding NEW, to the state line, I could request sites again (resolving the DNS I suppose). But I wonder how to configure rules to force my browser to give a 404 for http connections and not for https. I hope this helps? –  user229855 Jul 8 at 20:41
    
To which STATE line? –  MadHatter Jul 8 at 20:52
    
Hehe sorry, the one in the OUTPUT chain –  user229855 Jul 8 at 21:06
    
What do you mean by, allow all outgoing HTTPS and block all HTTP? Is this a client machine? –  Matt Jul 8 at 23:58

1 Answer 1

up vote 2 down vote accepted

I think there's nothing wrong with those rules as far as HTTP and HTTPS go. The problem is that you've also blocked DNS resolution, so no client can resolve a host in order to try an HTTPS connection thereto.

You have noted that adding NEW to the permitted states in line 1 of your OUTPUT chain allows DNS resolution - but it also allows everything else, including outbound HTTP; all the return-half packets are then permitted in by rule 1 of yourINPUT chain. Instead, revert to the ruleset above and allow DNS explicitly with

iptables -I OUTPUT 2 -p udp --dport 53 -j ACCEPT

That should allow the DNS resolution of hosts to work, but continue to block attempts to connect to them via HTTP. Note that the 404 you seek is a layer-4 (protocol layer) error, and you can't achieve that with a layer-3 tool like iptables. Instead, outbound HTTP connections will simply time out, whereas HTTPS connections should succeed.

share|improve this answer
    
Hi MadHatter , this is exactly where I was looking for! Many thanks for the patience and help :) –  user229855 Jul 9 at 9:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.