Why the default policy of iptables doesn't work?

Question

I wrote some rules to prevent all incomming packet from other computers in my private network except my router. That is why I still want my computer to access the Internet.

This is my rules:

iptables -F
iptables -P INPUT DROP
iptables -A INPUT -m mac --mac-source xx:xx:Xx:xx:xx:xx -j ACCEPT

It is a simple rule. xx:xx:Xx:xx:xx:xx is mac address of the router. I read the document so I know iptables -P INPUT DROP will drop all packets don't match with the below rule. In fact, the rules don't work. I just access to my router but I can not access the Internet. It's difficult to know because I make sure all incomming packets from the Internet come my computer with mac address of my router.

I wrote the rules to fix it:

iptables -F
iptables -P INPUT ACCEPT
iptables -A INPUT -m mac ! --mac-source xx:xx:xx:xx:Xx:xx -j DROP 

It works but I would like the idea "deny all, allow selected". It is simpler in configuration and design.

I hope someone makes me clear why the first rules do not work.

Answer 1

Thank you for your good advices. I found out the cause of the problem. This is my all rule:

-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -m mac --mac-source xx:xx:xx:xx:xx:xx -j LOG --log-prefix my_rule --log-level 6
-A INPUT -m mac --mac-source xx:xx:xx:xx:xx:xx -j ACCEPT
-A INPUT -i lo -j ACCEPT

Basically, the rule is right except I forgot the last rule for loopback interface. When I surf the Internet, some dns request needed to send to dns service on my computer via loopback interface. If I forget it, I can not resolv any domains.

At first, my solution is add a rule that accept any incomming request has mac address is 00:00:00:00:00:00 because I see this is the mac address of all requests sent via loopback interface but iptables seem not to know. No packet with 00:00:00:00:00:00 is accepted. I read the iptables manual but I still don't see the description of iptables behavior with mac address 00:00:00:00:00:00. I guess iptables think 00:00:00:00:00:00 means 'no mac address'

P/S: I am learning English. Sorry about my mistake in grammar.