0

With the following iptable rules, I was unable to do an apt update and ping a website. Whats wrong with the rules? How to fix it? What is the exact rule to fix it?

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:325 
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Improve this question
4
  • 1
    Remember, IPTables works on PACKETS and not Logical Connections. Every last packet except TCP port 325 is getting dropped from the incoming traffic.
    – Magellan
    Nov 9, 2012 at 4:15
  • Outgoing HTTP and HTTPS traffic is unblocked. The problem is that no rule lets the reply packets in. You probably want ESTABLISHED/RELATED rules.
    – David Schwartz
    Nov 9, 2012 at 5:25
  • @DavidSchwartz Can you please tell me how to do it?
    – THpubs
    Nov 9, 2012 at 5:30
  • Check out any iptables HOWTO or FAQ. For example, check out this page, specifically the rule to allow outgoing HTTPS and DNS. (Or do you want to allow all outbound connections to just work? If so, generate a similar rule for all ports, TCP and UDP.)
    – David Schwartz
    Nov 9, 2012 at 5:31

1 Answer 1

Reset to default
1

Get rid of the DROP rule in the INPUT chain. It's dropping virtually all traffic coming in to the machine, including responses to any traffic you send out.

Improve this answer
3
  • 1
    Then how to block un-needed incoming traffic? The default policy to drop?
    – THpubs
    Nov 9, 2012 at 4:16
  • That's a completely different question. :)
    – Michael Hampton
    Nov 9, 2012 at 4:17
  • Michael: the perfect "you're in a balloon" answer. Upvote!
    – MadHatter
    Nov 9, 2012 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.