1

I'm trying to add this rule as the final, after all the other rules that allow the traffic.

iptables -A INPUT -j DROP

And this rule blocks everything.

When connecting through the web port 80, nginx throws "502 Bad Gateway". My guess that it somehow blocks some port like the database which causes the application not to respond?

Thanks.

4
  • Perhaps you are setting this rule to a different interface? Look at iptables -L -v for more information. Feb 29, 2012 at 19:00
  • sorry I just edited the question, because it was badly formulated.
    – valk
    Feb 29, 2012 at 19:02
  • no, I allow everything like port 22, 80, 3000 etc, and adding this DROP rule as the last one. I ran nmap localhost, and basically allowed all the relevant ports from it's output. Possibly I'm blocking something on which the web app relies?
    – valk
    Feb 29, 2012 at 19:07
  • If that rule is blocking everything, then your rules to permit traffic are incomplete, broken, or wrong. We probably cannot do anything to help you without knowing more about the rest of your rules.
    – Zoredache
    Feb 29, 2012 at 19:08

2 Answers 2

5

Think about adding iptables -A INPUT -i lo -j ACCEPT as first rule. Typically you can allow loopback connections without worsening security (but be aware of consequences).

2
  • +1, My bets are on relevant local traffic not being allowed. Feb 29, 2012 at 19:26
  • +1 - i wasn't even aware that loopback was handled by iptables - seems obvious now, but good thing to mention
    – G. Bach
    Feb 29, 2012 at 23:34
1

Additionally you could simply set the default policy of the chain if this is the only thing you want to accomplish:

iptables -P INPUT DROP

To answer your question though, no, iptables doesn't just decide 'not to work'. Your rules are probably wrong. If you update your question with the relevant information we can help you further.

1
  • No problem, thanks for the vote if that was you :) I figured kupson was right since you mentioned the database, but I figured the comment would be helpful anyway :)
    – gparent
    Feb 29, 2012 at 19:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .