up vote 0 down vote favorite

trying to get s3cmd to work with aws s3 but i think iptables is getting in my way, i allow all http/https outbound traffic to any host as its a web server but its still not working for S3, im assuming i need something on the inbound ruleset as well?

just not sure what.

this is the output of iptables-save

-A INPUT -i eth0 -p tcp -m tcp --sport 47200 -m state --state ESTABLISHED -j ACCEPT
-A INPUT -s 68.2.71.66/32 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s 172.245.74.250/32 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p udp -m udp --dport 9987 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 30033 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 30033 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10011 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 10011 -j ACCEPT
-A INPUT -i eth0 -j DROP
-A OUTPUT -o eth0 -p tcp -m tcp --dport 47200 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 443 -m conntrack --ctstate NEW,RELATED,ESTABLISHED -j ACCEPT
-A f2b-sshd -s 221.194.47.224/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 121.18.238.98/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 221.194.47.229/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 221.194.47.249/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 119.249.54.75/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 221.194.47.208/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 119.249.54.88/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 197.221.234.20/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 119.249.54.68/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 121.18.238.104/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -j RETURN
COMMIT
# Completed on Wed Oct  5 00:45:48 2016
share|improve this question
    
Is IP tables stateful or stateless? You may need the return ports. S3 traditional goes over the internet, but recently has changed so you can use an internal gateway of some kind - I can't recall the details. Are you sure s3cmd uses port 80? – Tim Oct 5 '16 at 2:01
1  
@Tim is thinking of an S3 VPC Endpoint, which is an optional feature and only changes the way the VPC routing tables work -- S3 still uses public IP addresses and otherwise behaves no differently from the perspective of EC2. But... can you connect to any external web server from here? Based on these rules, I don't see how you possibly could, nor do I see rules allowing DNS traffic. – Michael - sqlbot Oct 5 '16 at 2:45
    
yeah i can connect to servers fine with the rules there.. like i said i dont block any real traffic outbound according to the rules i provided.. – gorelative Oct 6 '16 at 2:12
    
If your machine itself is an http/https server, things should work. If you want to connect from this machine to another http/https server, your rules block this. – corny Oct 13 '16 at 14:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.