LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-16-2010, 04:53 AM   #1
vincent.dang
LQ Newbie
 
Registered: Jan 2010
Posts: 15

Rep: Reputation: 0
Please help! Iptables


I am a big fan of Fedora 11. Also, I am using wireless broadband USB to access internet. For the sake of practising Iptables, I configured my Iptables as the following:

# Generated by iptables-save v1.4.3.1 on Sat Jan 16 16:50:19 2010
*filter
:INPUT DROP [49:5544]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [50:2918]
-A INPUT -i lo -j ACCEPT
-A INPUT -d 127.0.0.1/32 -p tcp -m tcp --tcp-flags FIN,SYN,ACK FIN,SYN,ACK -j AC
CEPT
-A INPUT -d 127.0.0.1/32 -p tcp -m state --state RELATED,ESTABLISHED -j
ACCEPT
-A INPUT -d 127.0.0.1/32 -p tcp -m state --state NEW -m tcp --sport 80 -
j ACCEPT
-A INPUT -d 127.0.0.1/32 -p tcp -m state --state NEW -m tcp --sport 443
-j ACCEPT
-A INPUT -d 127.0.0.1/32 -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -d 127.0.0.1/32 -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A INPUT -d 127.0.0.1/32 -p icmp -m icmp --icmp-type 0 -j ACCEPT
COMMIT
# Completed on Sat Jan 16 16:50:19 2010

When I use "service iptables stop". I can access internet. But when I start iptables, I couldn't access internet. Then I use this command "netstat -ant" to check if there is anything blocking access to internet. And this is the result:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:32773 0.0.0.0:* LISTEN
tcp 0 0 :::111 :::* LISTEN
tcp 0 0 :::22 :::* LISTEN
tcp 0 0 ::1:631 :::* LISTEN

It seems like there is something wrong with my iptables configuration but I am at my wit's end. I couldn't figure out why I couldn't access internet with my iptables on. And I am also Linux newbie. Any help would be appreciated.
 
Click here to see the post LQ members have rated as the most helpful post in this thread.
Old 01-16-2010, 05:26 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,332
Blog Entries: 55

Rep: Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533Reputation: 3533
Currently you allow "-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT" from your loopback device (127.0.0.1 aka "lo") but not your wireless network device. Check the output of ifconfig and iwconfig to find the devices name. Also please search LQ of "iptables" as we've got quite some threads by now listing rulesets you could read and use after modification.
 
2 members found this post helpful.
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
On what basis CHAIN integer values are generated in IPtables under iptables file? haariseshu Linux - Server 3 11-05-2009 05:25 AM
[SOLVED] Rather huge IPtables chain, iptables: Memory allocation problem. Gangrif Linux - Networking 10 09-11-2009 04:30 PM
iptables v1.2.9: Unknown arg `/sbin/iptables' Try `iptables -h' or 'iptables --help' Niceman2005 Linux - Security 4 12-29-2005 09:20 PM
IPtables Log Analyzer from http://www.gege.org/iptables/ brainlego Linux - Software 0 08-11-2003 07:08 AM
My iptables script is /etc/sysconfig/iptables. How do i make this baby execute on boo ForumKid Linux - General 3 01-22-2002 08:36 AM


All times are GMT -5. The time now is 03:10 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration