0

We recently noticed that outgoing HTTP traffic seems be blocked.

Specifically we need to allow HTTP requests to a give website URL. I'm not sure if this is possible as I believe typically it must be allowed to a specific IP. However, the service which we need to send traffic uses ELB and therefore the actual IPs of the instances can change.

Anyway, I've tried running telnet xxx.com 80 and it simply says:

Unable to connect to remote host: Connection timed out

Anyone know how we can allow the HTTP outgoing traffic to this website?

Thanks in advance.

Improve this question

2 Answers 2

Reset to default
1

You need to find out the IP ranges used by the website using ELB, and add iptables outgoing ALLOW rules to them. Since you didn't include any existing firewall configuration information in your question, I cannot give any more specific instructions.

Improve this answer
1
  • Thanks for quick reply :) I will ask them to the IP ranges but I'm not sure Amazon is able to provide this information. I'd be glad to share more details on the firewall configuration - what's best way to share that with you?
    – Aaron
    Jun 21, 2016 at 9:55
-1

You can use this:

iptables -A OUTPUT -p tcp -d xxx.com --dport 80 -j ACCEPT

You can use web address (but must be domain) for -d (destination) And don't forget att set allow also incoming traffic for same site:

iptables -A INPUT -p tcp -s xxx.com --dport 80 -j ACCEPT

Edit:

If that not goes ... you must make script with take info om ip addres whit command: host -t a xxx.com

Improve this answer
12
  • I'm not sure that using FQDNs in iptables rules works like you think it does.
    – MadHatter
    Jun 21, 2016 at 9:51
  • I tried to include the url within the iptables rules and did not have any success. How would I properly include the command host -t a xxx.com within the rule itself? Just not sure proper formatting...
    – Aaron
    Jun 21, 2016 at 9:57
  • format is for exmp: host -t a www.facebook.com and output is like: www.facebook.com has address 69.171.228.40 but it's not use in iptables rules ... you must make script at run iptables ...
    – Gruja
    Jun 21, 2016 at 10:25
  • 1
    Oh okay, I already have a script you can see here: goo.gl/YXkg5p can I add this into my existing script?
    – Aaron
    Jun 21, 2016 at 10:37
  • Yes you can. Take this code: host -t a siteadress.com > ip.txt ; awk '{print $4}' ip.txt ; rm ip.txt
    – Gruja
    Jun 21, 2016 at 11:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .