iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j DROP
I have the preceding rules in iptables on an ngnix server ubuntu 12.10 in ssh
Line 1 should allow the server to talk to itself.
Line 02 should allow me to ssh.
line 03 should allow http protocol.
Line 04 should drop everything else.
But even though line4 DROP rule is at the end. it "breaks" the server.
Everything times out. I have been in and reset all the timeout rules and nothing works.
I do not understand why dropping everything except http would cause this issue.
Racking my brains but just can't see the forest for the trees. Nothing seems to fix it.
Would anyone have a suggestion why that would cause issues like this and how to fix it?
iptables -L -n -v
into your question? Also, could you clarify what you mean by "it breaks the server"? An example, complete with output, would be best. And if you want a server to talk to itself - which you definitely should -iptables -I INPUT 1 -i lo -j ACCEPT
would probably be best.iptables -P INPUT DROP
), same for FORWARD and OUTPUT and write those at the top of my firewall scripts in a separate area together with the rules kokoto stated (allowing everything from localhost and related established) and put all rules that concern allowing external sources in a separate area (including ICMP) so you don't have to move your drop rule all the time and risk to make mistakes. I also separate the 3 areas INPUT, FORWARD and OUTPUT and comment everything.