Hi There,

I have a question regarding iptables on Debian. What am I doing wrong kind of question. I want to be able to monitor remote machines from my zabbix server. I have put in the following commands in hope of opening the input chain to ssh, http, zabbix_agent and zabbix_trap:

iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 10050 -j ACCEPT
iptables -A INPUT -p tcp --dport 10051 -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A INPUT -j DROP

I have not touched the output chain and it is wide open. Once I executed the last command "iptables -A INPUT -j DROP" I can no longer go out on port 10050 on remote machines.
telnet 1.2.3.4 10050 from the server times out.
ssh & http connections are fine btw.

Thank You.
Mark

Most types of communications have return traffic on higher numbered ports. For example, when you go to a web site, you connect to that server on it's port 80, but you are typically using a very high numbered port. Without a rule line to accept established and related connections, you communications will only be one way as the return traffic will be blocked. The trick is that you can't know in advance what the high numbered return port will be, hence you need to make use of the state-full functions of iptables. You could do this with a rule (place above or below your loopback rule) like this:

1 members found this post helpful.

Hi,

Thank you for the reply and the explanation. I did as you suggested and it works very nicely.

Thanx

I'm glad that worked for you. I thought you might also find these iptables tutorials interesting. There LOTS of them out there, but I think these are pretty good.
First: http://bodhizazen.net/Tutorials/iptables. There is also one from this author about preventing DOS attacks. Overall, the site is a good one with a lot of information.
Second: http://www.frozentux.net/iptables-tutorial/chunkyhtml/ This one is courtesy of Win32sux. It is a rather large document, but is comprehensive.

Thank you. I will check these sites out.