Here are the rules I setup..

iptables -P INPUT DROP
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT

When I try to make an outgoing connection, it gets blocked.

What's missing?

Here's the output from iptables -n -L

    Chain INPUT (policy DROP)
target     prot opt source               destination         
DROP       tcp  --             source IP range 
           tcp  --             tcp dpt:80 state NEW recent: SET name: DEFAULT side: source 
DROP       tcp  --             tcp dpt:80 state NEW recent: UPDATE seconds: 60 hit_count: 15 name: DEFAULT side: source 
ACCEPT     tcp  --             tcp dpt:80 
ACCEPT     tcp  --             tcp dpt:443 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Note.. the first rule is there to block a particular range and the next two are supposed to limit the number of requests anyone can make within 60 seconds.

  • Could you run "service iptables status" or "iptables -n -L" and update your post with that info. – Rilindo Dec 11 '11 at 1:53
  • I updated the question with the output from the command. – Miko Dec 11 '11 at 2:16
  • Please elaborate on When I try to make an outgoing connection, it gets blocked.. What do you mean by an "outgoing connection"? What happens when the connection is "blocked"? Command outputs, logs, etc. would be helpful. – Steven Monday Dec 11 '11 at 2:34

I don't see any rules that would allow an outgoing connection. Why do you think it should work? Perhaps you're missing the fact that if you make an outgoing connection to port 80, the return packets are from port 80, not to port 80.

If you want to make connection to port 80, you have two ways to let the return packets in:

1) Allow in packets from port 80.

2) Allow in packets that are part of an existing session.

I don't see any evidence you did either of these things.

  • The OUTPUT policy is to ACCEPT, and the ruleset for the OUTPUT chain is empty. So outgoing connections should be allowed, no? – Steven Monday Dec 11 '11 at 2:36
  • 1
    No. There's no rule to allow the packets in. Sure, you can send out the packets needed to establish the connection, but if your incoming rules block the returning packets, the connection won't actually work. – David Schwartz Dec 11 '11 at 2:38
  • Ah, yes, you're right. I saw your initial two-sentence answer and didn't think any more deeply about it. +1. – Steven Monday Dec 11 '11 at 2:46

To elaborate a bit on David's answer, you can allow in packets that are part of an existing session by adding the following rule to your filter table:

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Permitting input packets in the ESTABLISHED state will allow most all outgoing connections to work as you expect, including non-TCP "connectionless" stuff, such as DNS queries (UDP) and pings (ICMP).

Permitting input packets in the RELATED state enables you to receive ICMP error messages that may come back from connection attempts to administratively prohibited ports/hosts/networks and such.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.