Whith this rules I can't use wget to an external address or send emails through an external SMTP server:


# Flush all current rules from iptables
iptables -F

# Allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -P INPUT DROP
iptables -P FORWARD DROP

# Set access for localhost
iptables -A INPUT -i lo -j ACCEPT

# Accept packets belonging to established and related connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow incoming web traffic
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Save settings
/sbin/service iptables save

But if I add this, it works:

iptables -A INPUT -p udp -m udp --sport 53 -j ACCEPT
iptables -A INPUT -p tcp --sport 80 -j ACCEPT

Shouldn't the following rule allow any incoming connection originated by a previous request?

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

EDIT: when I run the script I get 2 errors:

iptables: Unknown error 4294967295
iptables: Unknown error 4294967295

I'm using CentOS 5.5 and iptables 1.3.5. Digging more I have found that there is a bug in this version: http://bugs.centos.org/view.php?id=3632 Can this be the cause of the problem?

EDIT 2: if I run demsg I get the same message repeated:

ip_tables: udp match: only valid for protocol 17

EDIT 3: Running iptables -L INPUT -v -n after a successfull wget shows:

# iptables -L INPUT -v -n
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   31  2020 ACCEPT     tcp  --  *      *             tcp dpt:22
    0     0 ACCEPT     all  --  lo     *  
    0     0 ACCEPT     tcp  --  *      *             tcp dpt:80
    0     0 ACCEPT     tcp  --  *      *             tcp dpt:443
    4   938 ACCEPT     udp  --  *      *             udp spt:53
   12 11439 ACCEPT     tcp  --  *      *             tcp spt:80

EDIT 4: Running sh -x script shows:

 # sh -x firewall.conf
+ iptables -F
+ iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+ iptables -P INPUT DROP
+ iptables -P FORWARD DROP
+ iptables -P OUTPUT ACCEPT
+ iptables -A INPUT -i lo -j ACCEPT
+ iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables: Unknown error 4294967295
+ iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables: Unknown error 4294967295
+ iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables: Unknown error 4294967295
+ iptables -A INPUT -p tcp --dport 80 -j ACCEPT
+ iptables -A INPUT -p tcp --dport 443 -j ACCEPT
+ /sbin/service iptables save
Saving firewall rules to /etc/sysconfig/iptables:          [  OK  ]
  • Show us what iptables-save displays. Also, what are your rules "Allow incoming web traffic" for? Do you have local WEB server? – poige Apr 1 '11 at 4:58
  • Hi, when I run iptables-save I get the errors in the first edit of the question and yes, it is a web server. – SCL Apr 1 '11 at 7:23

you dont have any rules in the OUTPUT chain and the default policy for it is DROP, so the initial tcp packets sent by your system when you try to open http or smtp connection get dropped. You need to add rules like these to permit outbound http and smtp for wget and email:

iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT

iptables -A OUTPUT -p tcp --dport 25 -m state --state NEW -j ACCEPT

you can consolidate them into one rule using multiport:

iptables -A OUTPUT -p tcp -m multiport --dports 25,80 -m state --state NEW -j ACCEPT

  • Edit: nevermind. – Sean C. Mar 31 '11 at 20:56
  • Hi vadimk, I have "iptables -P OUTPUT ACCEPT" so that should allow anything by default. I tried your suggestion but it still doesnt work. – SCL Mar 31 '11 at 21:39
  • sorry, my mistake. Since wget works when you add rule that matches source port 80 (the one with -sport 80), then you should focus on the rule that should permit reply packets by matching their state ESTABLISHED. Either state is not created or the rule can not match it. I wonder which iptables command causes that strange error "Unknown error". TRy to run your iptables script like "sh -x script" to see which one it is. May be module "state" is not available on your system. Also to separate firewall and DNS problems try to run wget using ip address of the server instead of the name. – vadimk Apr 1 '11 at 1:22
  • I run your test and it seems to be there the problem, as you said. So the only solution is to upgrade to a new version, as pepoluan suggests? – SCL Apr 1 '11 at 7:10
  • looks like you have two choices: either upgrade iptables to get the fix for this bug or run it stateless with the rule that matches source port 80. The latter has security risks in that it is easy to initiate connection from outside with source port 80 to any port on your machine and this rule will permit it. This renders all other rules in the INPUT chain that protect your server rather useless. – vadimk Apr 1 '11 at 17:40

Have you tried

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

It may be related to "state" module/kernel extension missing/having-issues/playing-mind-games (?).

May worth a try.

  • Hi jliendo, I tried but without luck. Thanks any way. – SCL Mar 31 '11 at 21:52

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

This is only doing connection tracking on data crossing the input chain. Your connection isn't established yet, you're still doing a three way handshake (TCP three way handshake). So conntrack is denying the connection as it should.

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

should fix it.

  • Hi Sean, i tried but it still does not work with your rule. – SCL Mar 31 '11 at 21:51
  • Based on your addition of ip_tables: udp match: only valid for protocol 17 I think there is a problem with the udp traffic coming back in. For diagnostics, add this iptables -A INPUT -p udp -j ACCEPT temporarily and see if it fixes the problem. – Sean C. Mar 31 '11 at 23:07
  • Actually, as a further measure, run this command after you are successful with the wget. iptables -L INPUT -v -n That will give you counters to show which rules are being matched. Check to see which one is allowing the return traffic through the chain. – Sean C. Mar 31 '11 at 23:10
  • 1
    @Sean no, you got that wrong. In conntrack, ESTABLISHED means a reply to an outgoing packet. conntrack's ESTABLISHED is different from TCP-Established state. This behavior enables conntrack to reat UDP replies as ESTABLISHED. – pepoluan Apr 1 '11 at 3:08
  • Can you run this on a terminal, maybe in screen, while you attempt the wget? It will show conntrack states for all open connections... watch -n 0.5 "cat /proc/net/ip_conntrack" -- It may help diagnose this. @pepoluan; I stand corrected. When I learned this information, I was given information and took it at face value without confirming it myself. I'll be reading over the conntrack docs tomorrow. Thanks. – Sean C. Apr 1 '11 at 3:14

I think you ought to update your iptables; mine's already version 1.4.10.

For instance, the 'Unknown error 4294967295' has been fixed in 1.3.6: http://ftp.netfilter.org/pub/iptables/changes-iptables-1.3.6.txt

Of course, this will very probably need a kernel update.

  • I did a complete yum update and still have the 1.3.5 version. It is the last version available from the repos. Is there another way to update it than building from source? – SCL Apr 1 '11 at 11:09
  • Hmm... that's tough then. the 'tricky' part with iptables is that it's intimately tied to the netfilter code in the kernel. if the repo does not have a newer version, you have to build from source so that it 'adapts' to your kernel. I am not familiar with CentOS; does it have user-repos? If so, try searching for a newer iptables from them. – pepoluan Apr 2 '11 at 1:55

You should "pair" the rules between INPUT and OUTPUT

Since outgoing wget is requesting to use port 21,80 and/or 443 TCP OUTPUT, and needs permission for "incoming INPUT" from sourceport 20,21,80 and/or 443 try this :

# rule OUT first :
iptables -A OUTPUT -p tcp -o ethX -d 0/0 -m multiport --dport 21,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT

# rule for "coming back" from OUT to INPUT :
iptables -A INPUT -p tcp -i ethX -s 0/0 -m multiport --sport 20,21,80,443 -m state --state ESTABLISHED -j ACCEPT

where ethX is your external eth interface (eth0 eth1 or whatever)

Rule for sending mails thru outer SMTP? Do the same, just change the dport and sport on each rule above

I hope that helps, it works for me.

Btw, My iptables is v1.3.5, and my default INPUT OUTPUT FORWARD policies set to DROP :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.