0 
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j DROP

I have the preceding rules in iptables on an ngnix server ubuntu 12.10 in ssh

Line 1 should allow the server to talk to itself.

Line 02 should allow me to ssh.

line 03 should allow http protocol.

Line 04 should drop everything else.

But even though line4 DROP rule is at the end. it "breaks" the server.

Everything times out. I have been in and reset all the timeout rules and nothing works.

I do not understand why dropping everything except http would cause this issue.

Racking my brains but just can't see the forest for the trees. Nothing seems to fix it.

Would anyone have a suggestion why that would cause issues like this and how to fix it?

Improve this question
6
  • 1
    Rules don't exist in isolation; could you cut-and-paste the output of iptables -L -n -v into your question? Also, could you clarify what you mean by "it breaks the server"? An example, complete with output, would be best. And if you want a server to talk to itself - which you definitely should - iptables -I INPUT 1 -i lo -j ACCEPT would probably be best.
    – MadHatter
    Aug 13, 2014 at 13:34
  • kokoto gave the right answer but I just wanted to add that I like to change the default policy to drop (iptables -P INPUT DROP), same for FORWARD and OUTPUT and write those at the top of my firewall scripts in a separate area together with the rules kokoto stated (allowing everything from localhost and related established) and put all rules that concern allowing external sources in a separate area (including ICMP) so you don't have to move your drop rule all the time and risk to make mistakes. I also separate the 3 areas INPUT, FORWARD and OUTPUT and comment everything.
    – Broco
    Aug 13, 2014 at 20:27
  • Sorry for the late response, This issue delayed something critical that had to be dealt with. thanks for all the feedback I will look at everything tonight.
    – Paul Jones
    Aug 15, 2014 at 6:44
  • Re server breaks. Everything times out and no pages are served, even though I have changed all time out requests. With that rule in place no pages get served at all. I tried " iptables -A INPUT -p DROP " but with the -p the tables through an error.
    – Paul Jones
    Aug 15, 2014 at 6:48
  • Chain INPUT (policy DROP 1 packets, 29 bytes)
    – Paul Jones
    Aug 15, 2014 at 7:40

1 Answer 1

Reset to default
1

your rules are fine but in order for the server to talk to itself you need to allow the localhost interface 

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT

And preferably icmp. hope that helps.

Edit: the -o to -i as suggested! Also it's worth mentioning that you have enabled port 443 for input right ?

Improve this answer
5
  • I don't think you mean -A INPUT -o lo! Try -i lo.
    – MadHatter
    Aug 13, 2014 at 13:41
  • Sorry for the late response, This issue delayed something critical that had to be dealt with. thanks for all the feedback I will look at everything tonight.
    – Paul Jones
    Aug 15, 2014 at 6:36
  • @port 443 not at this time. I would have thought allowing the server to talk to itself and opening http and ssh was all that was critically necessary. Will be looking into all this very shortly. Thanks for the help
    – Paul Jones
    Aug 15, 2014 at 6:43
  • -I INPUT 1 -i lo -j ACCEPT Worked fine. iptables -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT I would need to be: insert that using {line#} -i ? so it would become: iptables -A INPUT 4 -i -p icmp -m icmp --icmp-type any -j ACCEPT ? I would need to insert and I would also need the -p also. Not sure how to rewrite that to add.
    – Paul Jones
    Aug 15, 2014 at 8:48
  • Hi Paul, for the best support please provide is with the full iptables output with the following command iptables-save > firewall, you can then add the changes and restore the file in the following manner iptables-restore firewall
    – kokoto
    Aug 15, 2014 at 11:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .