LinuxQuestions.org - iptables and outgoing connections

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - iptables and outgoing connections (https://www.linuxquestions.org/questions/linux-security-4/iptables-and-outgoing-connections-765566/)

iptables and outgoing connections

scenario: I can ping my machine but I cant ping from that machine to other hosts.
I accept icmp and the output chain is default accept

Output of iptables -vL
http://pastebin.com/m58335897

It is fixed when i set the default for input to accept, so i guess im missing something i should accept.
I cant figure out what im doing wrong, could somebody give me a hint?

It seems to be the same for other outgoing connections so it might not be specific for icmp

What happens if you remove the protocol match from your RELATED,ESTABLISHED rule?

Quote:

Originally Posted by win32sux (Post 3737958)

What happens if you remove the protocol match from your RELATED,ESTABLISHED rule?

no change

edit: wait, i misunderstood, let me test that

Quote:

Originally Posted by Dutchy_ (Post 3738036)

edit: wait, i misunderstood, let me test that

That fixed the problem: can you explain why this failed in the first place? I thought if a rule didnt match it would go to the next one.

Quote:

Originally Posted by Dutchy_ (Post 3738048)

That fixed the problem: can you explain why this failed in the first place?

Actually, I'm not exactly sure. When this box pings another box, the echo reply packet is sent to ACCEPT because it matches ESTABLISHED in the INPUT chain. It wasn't doing that before since the TCP match would prevent the ICMP packet from matching. That said, even with the TCP match enabled, I would have expected the echo reply packet to match the last rule in the chain, which AFAICT sends every ICMP packet to ACCEPT.

Code:

Chain INPUT (policy DROP 270 packets, 31057 bytes)

 pkts bytes target    prot opt in    out    source              destination

56032 7578K ACCEPT    tcp  --  any    any    anywhere            anywhere            state RELATED,ESTABLISHED

 1056 54516 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:www

    9  540 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:ftp

    0    0 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:ssh

  21  1156 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:smtp

  242 12376 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:pop3

    9  540 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:imap2

    0    0 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:https

    0    0 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:imaps

    0    0 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:pop3s

  113  6780 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:mysql

    2  104 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:http-alt

    0    0 ACCEPT    tcp  --  any    any    anywhere            anywhere            tcp dpt:webmin

    0    0 ACCEPT    icmp --  any    any    anywhere            anywhere



Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)

 pkts bytes target    prot opt in    out    source              destination



Chain OUTPUT (policy ACCEPT 114K packets, 103M bytes)

 pkts bytes target    prot opt in    out    source              destination

Let me see if I can reproduce this on my box.

Okay, after doing some tests on my box (and re-reading your configuration), I'm willing to bet that although you weren't able to ping by host name, you were able to ping by IP. Can you confirm this?

I suspect that this was simply a case of the DNS lookups not being able to take place, due to their being no way for the returning UDP packets to be allowed. In other words, I theorize that you weren't receiving echo replies at all, because your echo requests weren't being sent in the first place. If I'm correct, then what happened when you removed the TCP match from your RELATED,ESTABLISHED rule was that you allowed DNS lookups to complete.

You are correct. I should have realised this, because ping gave no output at all.

On to the next problem, with these rules ftp doesn't work yet :) If you have any suggestions, they are welcome. I am going to wait a bit with debugging till tonight, it's on a production server (don't ask).

You have the FTP connection tracking module loaded, right?

Quote:

Originally Posted by win32sux (Post 3738102)

You have the FTP connection tracking module loaded, right?

I didn't, I thought it was all one module that could do the tracking :) I think I'll figure it out now, thanks a lot :)