I'm trying to add this rule as the final, after all the other rules that allow the traffic.

iptables -A INPUT -j DROP

And this rule blocks everything.

When connecting through the web port 80, nginx throws "502 Bad Gateway". My guess that it somehow blocks some port like the database which causes the application not to respond?


  • Perhaps you are setting this rule to a different interface? Look at iptables -L -v for more information. – Belmin Fernandez Feb 29 '12 at 19:00
  • sorry I just edited the question, because it was badly formulated. – valk Feb 29 '12 at 19:02
  • no, I allow everything like port 22, 80, 3000 etc, and adding this DROP rule as the last one. I ran nmap localhost, and basically allowed all the relevant ports from it's output. Possibly I'm blocking something on which the web app relies? – valk Feb 29 '12 at 19:07
  • If that rule is blocking everything, then your rules to permit traffic are incomplete, broken, or wrong. We probably cannot do anything to help you without knowing more about the rest of your rules. – Zoredache Feb 29 '12 at 19:08

Think about adding iptables -A INPUT -i lo -j ACCEPT as first rule. Typically you can allow loopback connections without worsening security (but be aware of consequences).

| improve this answer | |
  • +1, My bets are on relevant local traffic not being allowed. – Aaron Copley Feb 29 '12 at 19:26
  • +1 - i wasn't even aware that loopback was handled by iptables - seems obvious now, but good thing to mention – G. Bach Feb 29 '12 at 23:34

Additionally you could simply set the default policy of the chain if this is the only thing you want to accomplish:

iptables -P INPUT DROP

To answer your question though, no, iptables doesn't just decide 'not to work'. Your rules are probably wrong. If you update your question with the relevant information we can help you further.

| improve this answer | |
  • gparent, thank you. – valk Feb 29 '12 at 19:50
  • No problem, thanks for the vote if that was you :) I figured kupson was right since you mentioned the database, but I figured the comment would be helpful anyway :) – gparent Feb 29 '12 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.