1

I've configured firewall rules using iptables. Outbound packets are being blocked. It seems like outbound packets are enabled. Does the use of bonding change anything, or do I just have incomplete rules?

/sbin/iptables -A INPUT -i bond0 -j ACCEPT
/sbin/iptables -A OUTPUT -o bond0 -j ACCEPT
/sbin/iptables -A OUTPUT -o bond1 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -j DROP
/sbin/service iptables save
Improve this question
5
  • 1) Can you reformat it so it's easier to read (indent commands 4 spaces so they become a code block. 2) Does this work without the firewall (so we know it's not the bonding that's the problem?) 3) Can you show us iptables -nL OUTPUT (indent 4 spaces...)
    – DerfK
    Oct 22, 2010 at 2:54
  • 1)Indented:/sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save
    – IAPaddler
    Oct 23, 2010 at 15:37
  • /sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save
    – IAPaddler
    Oct 23, 2010 at 15:38
  • 1) Indented /sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save
    – IAPaddler
    Oct 23, 2010 at 15:41
  • @IAPaddler you're supposed to edit your question and indent all outputs, like what @Zoredache had done. That said, please post the output of iptables-save (again, edit your question!)
    – pepoluan
    Aug 19, 2011 at 12:49

1 Answer 1

Reset to default
1

Bonding does not make a difference.

If that is the complete rule set, then your problem isn't that you are blocking outbound packets. I suspect if you ran a capture on some device outside, you would see packets leaving your system, and you would even see replies.

The easiest way to fix this would be to simply use a couple stateful rules like these. They will permit your system to make outbound connections, and the connection tracking will permit the response to be accepted on the INPUT side.

/sbin/iptables -t filter -A OUTPUT -m state --state NEW\,ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A INPUT -m state --state ESTABLISHED -j ACCEPT
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .