When I type something like sudo apt-get install firefox, everything work until it asks me:

After this operation, 77 MB of additional disk space will be used.
Do you want to continue [Y/n]? Y

Then error messages are displayed: Failed to fetch: <URL>

My iptables rules are as follows:


-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

What should I add to allow apt-get to download updates? Thanks


apt-get almost always downloads over HTTP but may also use FTP, so the short answer is probably to allow outbound HTTP connections... and also DNS, of course.

The configuration you have now disallows all outgoing network traffic (the ESTABLISHED rule you have on the OUTPUT chain isn't effective since no sessions will ever get established). Do you need to allow ONLY apt-get updates while still disallowing everything else? iptables is probably the wrong tool for that job as it isn't really going to interpret URLs and allow HTTP transfers selectively. You'd want to use an HTTP proxy server for this job.

You can use a simpler setup that will permit apt-get downloads, but be aware that this also permits all other outgoing DNS and HTTP connections, which may not be what you want.

iptables -F OUTPUT  # remove your existing OUTPUT rule which becomes redundant
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -m state --state NEW -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -m state --state NEW -j ACCEPT

If your APT sources include HTTPS or FTP sources or HTTP sources on ports other than 80, you'll have to add those ports too.

Next, you will have to permit the return traffic. You can do that with this single rule that permit any established connection:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

(It is safe to allow all inbound established connections when using connection tracking, because only connections that you have otherwise allowed will get to the ESTABLISHED state.)

| improve this answer | |
  • 1
    Hi, thanks for your response. It worked, but do you think there could be any security concern with opening up these OUTPUT ports? Thanks – anthony01 Sep 29 '12 at 19:57
  • 2
    Most firewalls, including virtually all SOHO-style boxes, permit unrestricted outbound connections. People usually have no requirement to restrict outgoing traffic. But it depends on your requirements. Your existing setup prevents users on the workstation in question from browsing the Internet. If this is what you need to do, then you cannot use this iptables-based solution because it causes web browsing to be permitted. – Celada Sep 29 '12 at 20:02
  • And if the intent is to block web browsing, that's the wrong tool anyway. Using NetFilter/IPTables to block all outbound connections in order to prevent staff web browsing is like using a bazooka to open a walnut. You need a transparent web proxy that will log for inappropriate usage while allowing work-related browsing for authorized users. – Magellan Sep 30 '12 at 4:02
  • After hours of searching, this answer finally helped me solve problems with my own local server. No matter what I did, all outgoing traffic was blocked until I explicitly allowed DNS connections via port 53. It makes sense though, because my package manager complained that it could not resolve hosts. – Onion Aug 24 '15 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.