The problem:
Cannot receive packets from the web, I can send email but not receive it for eg. Also, clicking buttons on web pages just times out. I guess I've inadvertetly blocked incoming packets that I want to receive. Here's the result of iptables -L

[root@indigo-prime sbin]# ./iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination

Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

Chain RH-Lokkit-0-50-INPUT (0 references)
target prot opt source destination


The idea is supposed to be that anything I send gets out, which seems to work. Anything cming in is blocked unless told otherwise... or if it is associated with something I sent out. i.e. a link or a button press on a web page - anything associated with that should get back to me. Also, when I hit "send receive" on ximian email... but this bit dosn't happen.
Thanx for input.

I'm building such a set of "howto's" here I'll soon be able to start paying all this help forward
Simon

Hang on . . . I think I see the problem . . .
there should be another line in there under input

I should have done:

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

???

I'll have to go away to try this out.
Meantime, suggestions are welcome.

(Note, this firewall is the simplest of the threads I've seen - newbies not running a network or a server will probably appreciate this.)
Simon

Hah! Serves me right - everything seems to be working fine now
Typical - I phrase a question and a solution presents itself *after* I've made it public!
For those with trouble wot come up with this thread in a search here's what I have ended up doing:

Default firewalls tend to be the "admit all unless told otherwise" type. Dunno why, they're stupid. However, it can be changed:

(get rid of the existing firewall)
iptables --flush
iptables --flush -t nat

(stop everything)
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP

(let network traffic through the loopback device)
iptables -A OUTPUT -j ACCEPT -o lo
iptables -A INPUT -j ACCEPT -i lo

(outgoing communication)
iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

(allow ssh)
iptables -A INPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT --dport 22

which should (someone correct me) protect a standalone system without interfering with you doing stuff. It won't make you invisibel though.

suggestions?

whoops posted into the wrong thread...