iptables and outgoing connections

Dutchy_ · 10-30-2009, 08:38 AM

scenario: I can ping my machine but I cant ping from that machine to other hosts.
I accept icmp and the output chain is default accept

Output of iptables -vL
http://pastebin.com/m58335897

It is fixed when i set the default for input to accept, so i guess im missing something i should accept.
I cant figure out what im doing wrong, could somebody give me a hint?

It seems to be the same for other outgoing connections so it might not be specific for icmp

win32sux · 10-30-2009, 09:14 AM

What happens if you remove the protocol match from your RELATED,ESTABLISHED rule?

Dutchy_ · 10-30-2009, 10:10 AM

Quote:

Originally Posted by win32sux

What happens if you remove the protocol match from your RELATED,ESTABLISHED rule?

no change

edit: wait, i misunderstood, let me test that

Dutchy_ · 10-30-2009, 10:22 AM

Quote:

Originally Posted by Dutchy_

edit: wait, i misunderstood, let me test that

That fixed the problem: can you explain why this failed in the first place? I thought if a rule didnt match it would go to the next one.

win32sux · 10-30-2009, 10:32 AM

Quote:

Originally Posted by Dutchy_

That fixed the problem: can you explain why this failed in the first place?

Actually, I'm not exactly sure. When this box pings another box, the echo reply packet is sent to ACCEPT because it matches ESTABLISHED in the INPUT chain. It wasn't doing that before since the TCP match would prevent the ICMP packet from matching. That said, even with the TCP match enabled, I would have expected the echo reply packet to match the last rule in the chain, which AFAICT sends every ICMP packet to ACCEPT.

Code:

Chain INPUT (policy DROP 270 packets, 31057 bytes)
 pkts bytes target     prot opt in     out     source               destination
56032 7578K ACCEPT     tcp  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
 1056 54516 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:www
    9   540 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ftp
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh
   21  1156 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:smtp
  242 12376 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:pop3
    9   540 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:imap2
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:imaps
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:pop3s
  113  6780 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:mysql
    2   104 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:http-alt
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:webmin
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 114K packets, 103M bytes)
 pkts bytes target     prot opt in     out     source               destination

Let me see if I can reproduce this on my box.

win32sux · 10-30-2009, 10:55 AM

Okay, after doing some tests on my box (and re-reading your configuration), I'm willing to bet that although you weren't able to ping by host name, you were able to ping by IP. Can you confirm this?

I suspect that this was simply a case of the DNS lookups not being able to take place, due to their being no way for the returning UDP packets to be allowed. In other words, I theorize that you weren't receiving echo replies at all, because your echo requests weren't being sent in the first place. If I'm correct, then what happened when you removed the TCP match from your RELATED,ESTABLISHED rule was that you allowed DNS lookups to complete.

Dutchy_ · 10-30-2009, 11:08 AM

You are correct. I should have realised this, because ping gave no output at all.

On to the next problem, with these rules ftp doesn't work yet

If you have any suggestions, they are welcome. I am going to wait a bit with debugging till tonight, it's on a production server (don't ask).

win32sux · 10-30-2009, 11:12 AM

You have the FTP connection tracking module loaded, right?

Dutchy_ · 10-30-2009, 01:48 PM

Quote:

Originally Posted by win32sux

You have the FTP connection tracking module loaded, right?

I didn't, I thought it was all one module that could do the tracking

I think I'll figure it out now, thanks a lot