help with iptables

shawn1 · 08-11-2011, 02:11 PM

I am trying to configure iptables for only HTTP and HTTPS traffic. I start by blocking all traffic, which works, via:

Code:

iptables -F
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

I then try to allow HTTP and HTTPS on eth0 with these commands, which does not work:

Code:

iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

Code:

iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

After these commands I should be able to access the internet. Does anyone know why this is not working?

Thanks

acid_kewpie · 08-11-2011, 02:28 PM

you want to go OUT to access the net? Those commands are for a webserver with incoming traffic. swap each pair of commands at the point where is says "tcp"

shawn1 · 08-11-2011, 02:40 PM

Quote:

Originally Posted by acid_kewpie

you want to go OUT to access the net? Those commands are for a webserver with incoming traffic. swap each pair of commands at the point where is says "tcp"

Yes. this is just for a desktop computer accessing the net. I believe this is what you wanted me to do:

Code:

iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

Code:

iptables -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

Tried that, now it just says web page unavailable. Before it didn't even do that, and was just stuck loading the page.

eSelix · 08-11-2011, 02:46 PM

You also need access to DNS and probably DHCP if you using it. DNS is on port 53 udp or sometimes tcp and DHCP is on 67 and 68 udp.

frankbell · 08-11-2011, 08:28 PM

One of the members of my LUG did a presentation on iptables and posted his script to the LUG website. Maybe it will help.