1

I've configured firewall rules using iptables. Outbound packets are being blocked. It seems like outbound packets are enabled. Does the use of bonding change anything, or do I just have incomplete rules?

/sbin/iptables -A INPUT -i bond0 -j ACCEPT
/sbin/iptables -A OUTPUT -o bond0 -j ACCEPT
/sbin/iptables -A OUTPUT -o bond1 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -j DROP
/sbin/service iptables save
  • 1) Can you reformat it so it's easier to read (indent commands 4 spaces so they become a code block. 2) Does this work without the firewall (so we know it's not the bonding that's the problem?) 3) Can you show us iptables -nL OUTPUT (indent 4 spaces...) – DerfK Oct 22 '10 at 2:54
  • 1)Indented:/sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save – IAPaddler Oct 23 '10 at 15:37
  • /sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save – IAPaddler Oct 23 '10 at 15:38
  • 1) Indented /sbin/iptables -A INPUT -i bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond0 -j ACCEPT /sbin/iptables -A OUTPUT -o bond1 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -i bond1 -j DROP /sbin/service iptables save – IAPaddler Oct 23 '10 at 15:41
  • @IAPaddler you're supposed to edit your question and indent all outputs, like what @Zoredache had done. That said, please post the output of iptables-save (again, edit your question!) – pepoluan Aug 19 '11 at 12:49
1

Bonding does not make a difference.

If that is the complete rule set, then your problem isn't that you are blocking outbound packets. I suspect if you ran a capture on some device outside, you would see packets leaving your system, and you would even see replies.

The easiest way to fix this would be to simply use a couple stateful rules like these. They will permit your system to make outbound connections, and the connection tracking will permit the response to be accepted on the INPUT side.

/sbin/iptables -t filter -A OUTPUT -m state --state NEW\,ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A INPUT -m state --state ESTABLISHED -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.