0

I am making a script with iptables on the firewall machine and when executing it and I want to ping a web page I get an error: ping: www.facebook.com: Temprary failed to name resolution and this happens when I run the script, when I restart everything goes perfectly without any problem, I also tried resolv.conf and it doesn't work.

PS: There are two interfaces enp0s3 that goes to the internet and another one enp0s8 that is from an Internal LAN

I pass you the script

sudo iptables -F

sudo iptables -X

sudo iptables -Z

sudo iptables -t nat -F

sudo iptables -P INPUT DROP

sudo iptables -P OUTPUT DROP

sudo iptables -P FORWARD DROP

sudo iptables -t nat -A PREROUTING -i enp0s3 -p tcp --dport 80 -j DNAT --to-destination 172.16.30.10:80
sudo iptables -t nat -A PREROUTING -i enp0s3 -p tcp --dport 443 -j DNAT --to-destination 172.16.30.10:443
sudo iptables -t nat -A PREROUTING -i enp0s3 -p tcp --dport 22 -j DNAT --to-destination 172.16.30.11:22

sudo iptables -t nat -A POSTROUTING -s 172.16.30.0/24 -o enp0s3 -j MASQUERADE

sudo iptables -A FORWARD -i enp0s3 -o enp0s8 -p tcp --dport 22 -d 172.16.30.11 -j ACCEPT

sudo iptables -A FORWARD -i enp0s8 -o enp0s3 -m state --state ESTABLISHED, RELATED -j ACCEPT

sudo iptables -A FORWARD -o enp0s3 -i enp0s8 -s 172.16.30.0/24 -p icmp -j ACCEPT

sudo iptables -A FORWARD -i enp0s3 -o enp0s8 -s 172.16.30.0/24 -p icmp -j ACCEPT


sudo iptables -A FORWARD -i enp0s8 -o enp0s3 -s 172.16.30.0/24 -p udp --dport 53 -j ACCEPT

sudo iptables -A FORWARD -o enp0s8 -i enp0s3 -d 172.16.30.0/24 -p udp --dport 53 -j ACCEPT

sudo iptables -A FORWARD -i enp0s8 -o enp0s3 -s 172.16.30.0/24 -p tcp --dport 80 -j ACCEPT
sudo iptables -A FORWARD -o enp0s8 -i enp0s3 -s 172.16.30.0/24 -p tcp --dport 80 -j ACCEPT

sudo iptables -A FORWARD -i enp0s8 -o enp0s3 -s 172.16.30.0/24 -p tcp --dport 443 -j ACCEPT
sudo iptables -A FORWARD -o enp0s8 -i enp0s3 -s 172.16.30.0/24 -p tcp --dport 443 -j ACCEPT

sudo iptables -A INPUT -d 172.16.30.1 -p icmp -j DROP

sudo iptables -A OUTPUT -o enp0s3 -p icmp -j ACCEPT

sudo iptables -A INPUT -i enp0s3 -p icmp -j ACCEPT


sudo iptables -A OUTPUT -o enp0s8 -p icmp -j ACCEPT

sudo iptables -A INPUT -i enp0s8 -p icmp -j ACCEPT 

5
  • did you allow port 53 tcp/udp? or uding a local cache Nameserver?
    – djdomi
    Mar 28, 2021 at 10:23
  • what do you mean "you tried resolv.conf"? Do you mean that you manually added the IP address for Facebook in there? Can you ping the IP address for Facebook?
    – Shōgun8
    Mar 28, 2021 at 10:54
  • 1
    Besides missing a rule to allow 53 outgoing, you seem to be missing a commonly used rule or equivalent: ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED. This allows traffic back in from sessions originating from your machine -- including DNS replies which currently would be dropped even if you did allow it out. Mar 28, 2021 at 14:49
  • with iptables how can i include? Mar 28, 2021 at 15:13
  • What do you want to include? To add a rule at the end, iptables -A <chain>. To insert a rule before position 10, iptables -I <chain> 10. See the manual page. Mar 28, 2021 at 23:10

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.