0

I have the following scenario:
I only want to allow access to 22, 80 and 443 ports and everything else permit.

My iptables -L looks like this:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             state RELATED,ESTABLISHED
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

But I can't get the desired effect, and even from my server I can't ping anything anymore ( can't get on the internet anymore ).

Also, I looked at option to set INPUT policy to DROP and manually open the desired ports but that didn't take the desired effect either.

Is there any difference in putting the DROP policy on INPUT chain and manually open the desired ports and the way I did it by dropping all traffic as the last rule.

Thanks a bunch,
Best regards.

Improve this question
4
  • That ruleset looks perfectly fine. What exactly isn't working? How are you testing?
    – larsks
    Commented Aug 23, 2015 at 16:30
  • As it can be seen from the ruleset, I can ssh into my server ( it's on my local network ), but from it I can't access anything. I can't even ping 8.8.8.8 ( there's no internet access ) nor I can event access services from my other workstations on that server.
    – user294262
    Commented Aug 23, 2015 at 16:35
  • Maybe add a LOG rule just before your DROP rule to see what you're dropping? You're not blocking any outbound traffic, and the RELATED,ESTABLISHED rule should permit any return traffic from outbound connections. Might not be an iptables problem.
    – larsks
    Commented Aug 23, 2015 at 18:16
  • Remember that you need to use -v to see the complete rule.
    – Michael Hampton
    Commented Aug 23, 2015 at 18:45

1 Answer 1

Reset to default
1

Your current setup for INPUT chain allows clients to connect to your server on tcp 22, 80 and 443 and the tcp connections you initiate to be replied. That's it! No icmp (for ping), no udp (DNS lookups).

Having your ESTABLISHED, RELATED rule ALLOW all protocols, instead of just tcp, should fix the above.

Regarding dropping everything using a rule versus DROP policy:

iptables -P INPUT DROP

Is the same thing as having:

iptables -A INPUT -j DROP

As your last rule.

Also, unless you know exactly what you're doing, you should fully allow loopback traffic.

Improve this answer
1
  • Thanks petry, that's it. I have added icmp rule and a few loopback entries and everything works now. Also, thanks for the clarification on the differences between the DROP policy and dropping the traffic manually.
    – user294262
    Commented Aug 24, 2015 at 9:09

You must log in to answer this question.