iptables tracking machine

eranb2 · 01-07-2005, 08:16 AM

Hi
I'm trying to understand ho it works.
1. droped all in out packets
2. accepted related and established connections.
cant connect to my dsl provider because name server dosnt found.
this is what I gave him
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptbles -L gives:

Chain INPUT (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED

Thanks
Eran

twsnnva · 01-07-2005, 09:49 AM

You probably have the "DROP ALL" rules before the ALLOW rules, which would cause your problem. Instead of using rules to drop everyting, you could use a policy. Try using a script like this.

Code:

#This flushes all rules
iptables -F 

#This flushes all nat rules
iptables -F -t nat 

#This deletes any user defined chains
iptables -X 

#This sets the INPUT chain's policy to drop by default
iptables -P INPUT DROP 

#This sets the OUTPUT chain's policy  to drop by default
iptables -P OUTPUT DROP 

#This sets the FORWARD chain's policy to drop by default
iptables -P FORWARD DROP 

#This allows any related traffic back to the system to be accepted
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#This allows all traffic out of the system
iptables -A OUTPUT -j ACCEPT

Thomas

eranb2 · 01-07-2005, 10:46 AM

Hi
thanks for replying

do you meen I need to put all the allow before the drop rules?
any way I did what you say and still can't connect
this is what i get:

out;: Host name lookup failure
fatal[get_ip_address

ptp.c:236]: gethostbyname: name server error
SIOCADDRT: File exists

I did what this link says and its same as your idea, but not working.

Eran

eranb2 · 01-07-2005, 10:50 AM

I forgot

whats the difference between policy drop and
iptables -I INPUT -j DROP ?

Eran

eranb2 · 01-07-2005, 11:12 AM

ok , i think i understand now.
i add
iptables -A INPUT -p udp --sport 53 -j ACCEPT
and working