0
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j DROP

I have the preceding rules in iptables on an ngnix server ubuntu 12.10 in ssh

Line 1 should allow the server to talk to itself.

Line 02 should allow me to ssh.

line 03 should allow http protocol.

Line 04 should drop everything else.

But even though line4 DROP rule is at the end. it "breaks" the server.

Everything times out. I have been in and reset all the timeout rules and nothing works.

I do not understand why dropping everything except http would cause this issue.

Racking my brains but just can't see the forest for the trees. Nothing seems to fix it.

Would anyone have a suggestion why that would cause issues like this and how to fix it?

  • 1
    Rules don't exist in isolation; could you cut-and-paste the output of iptables -L -n -v into your question? Also, could you clarify what you mean by "it breaks the server"? An example, complete with output, would be best. And if you want a server to talk to itself - which you definitely should - iptables -I INPUT 1 -i lo -j ACCEPT would probably be best. – MadHatter Aug 13 '14 at 13:34
  • kokoto gave the right answer but I just wanted to add that I like to change the default policy to drop (iptables -P INPUT DROP), same for FORWARD and OUTPUT and write those at the top of my firewall scripts in a separate area together with the rules kokoto stated (allowing everything from localhost and related established) and put all rules that concern allowing external sources in a separate area (including ICMP) so you don't have to move your drop rule all the time and risk to make mistakes. I also separate the 3 areas INPUT, FORWARD and OUTPUT and comment everything. – Broco Aug 13 '14 at 20:27
  • Sorry for the late response, This issue delayed something critical that had to be dealt with. thanks for all the feedback I will look at everything tonight. – Paul Jones Aug 15 '14 at 6:44
  • Re server breaks. Everything times out and no pages are served, even though I have changed all time out requests. With that rule in place no pages get served at all. I tried " iptables -A INPUT -p DROP " but with the -p the tables through an error. – Paul Jones Aug 15 '14 at 6:48
  • Chain INPUT (policy DROP 1 packets, 29 bytes) – Paul Jones Aug 15 '14 at 7:40
1

your rules are fine but in order for the server to talk to itself you need to allow the localhost interface

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT

And preferably icmp. hope that helps.

Edit: the -o to -i as suggested! Also it's worth mentioning that you have enabled port 443 for input right ?

  • I don't think you mean -A INPUT -o lo! Try -i lo. – MadHatter Aug 13 '14 at 13:41
  • Sorry for the late response, This issue delayed something critical that had to be dealt with. thanks for all the feedback I will look at everything tonight. – Paul Jones Aug 15 '14 at 6:36
  • @port 443 not at this time. I would have thought allowing the server to talk to itself and opening http and ssh was all that was critically necessary. Will be looking into all this very shortly. Thanks for the help – Paul Jones Aug 15 '14 at 6:43
  • -I INPUT 1 -i lo -j ACCEPT Worked fine. iptables -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT I would need to be: insert that using {line#} -i ? so it would become: iptables -A INPUT 4 -i -p icmp -m icmp --icmp-type any -j ACCEPT ? I would need to insert and I would also need the -p also. Not sure how to rewrite that to add. – Paul Jones Aug 15 '14 at 8:48
  • Hi Paul, for the best support please provide is with the full iptables output with the following command iptables-save > firewall, you can then add the changes and restore the file in the following manner iptables-restore firewall – kokoto Aug 15 '14 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.