Why this script cannot enable surfing?

Niceman2005 · 12-24-2005, 10:23 AM

Dear friends,

I have the following firewall script, all I want to experiment is a script that stops everything else but allow internet surfing. the script is as follow:

#!/bin/sh

iptables="/sbin/iptables"

$iptables -P FORWARD DROP
$iptables -P INPUT DROP
$iptables -P OUTPUT DROP

$iptables -A OUTPUT -p tcp -m state --state NEW --destination-port 80 -j ACCEPT

$iptables -A OUTPUT -p udp -m state --state NEW --destination-port 53 -j ACCEPT

$iptables -A OUTPUT -p tcp -m state --state NEW --destination-port 53 -j ACCEPT

$iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED --destination-port 80 -j ACCEPT

$iptables -A INPUT -p udp -m state --state ESTABLISHED,RELATED --destination-port 53 -j ACCEPT

$iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED --destination-port 53 -j ACCEPT
echo "firewall rules applied"

As seen above, i have enabled DNS port 53, http port 80 but it doesn't allow internet surfing...where did I go wrong here?

thanks for takin time reading my thread...thanks a lot.

regards
Fong

win32sux · 12-24-2005, 04:12 PM

give this cleaned-up version of your script a shot:

Code:

#!/bin/sh

iptables="/sbin/iptables"

echo "0" > /proc/sys/net/ipv4/ip_forward

$iptables -F
$iptables -F -t nat
$iptables -F -t mangle

$iptables -X
$iptables -X -t nat
$iptables -X -t mangle

$iptables -P FORWARD DROP
$iptables -P INPUT DROP
$iptables -P OUTPUT DROP

$iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A OUTPUT -o lo -j ACCEPT
$iptables -A OUTPUT -p tcp -m state --state NEW --dport 80 -j ACCEPT
$iptables -A OUTPUT -p udp -m state --state NEW --dport 53 -j ACCEPT
$iptables -A OUTPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT

$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A INPUT -i lo -j ACCEPT

echo "firewall rules applied"

haertig · 12-24-2005, 04:24 PM

Quote:

Originally Posted by Niceman2005

$iptables -A OUTPUT -p tcp -m state --state NEW --destination-port 80 -j ACCEPT

The above rule will allow your outgoing requests to port 80 (web surfing traffic) for initial connections (SYN), but it won't allow subsequent packets (ACK, etc.) I don't believe. This because you limited the rule to "--state NEW". I'd modify it to:

$iptables -A OUTPUT -p tcp --destination-port 80 -j ACCEPT

Quote:

$iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED --destination-port 80 -j ACCEPT

I think you intended for this rule to allow the incoming replies to your web surfing traffic, but it won't. You limited it to only things coming in on port 80, which is not where you web surfing replies will be coming. These replies will be coming back to higher numbered ports (random). Ports above 1025. Simply remove the "--destination-port 80" part so your rule looks like this:

$iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

Niceman2005 · 12-25-2005, 01:31 AM

thanks a lot friends!

Your help helped me to understand better now. thanks a lot!

fotoguy · 01-09-2006, 04:37 AM

Is this running on a router with 2 network cards or a workstation with a single network card?

Niceman2005 · 01-09-2006, 05:55 AM

This one I am working on a workstation.
Its ok now, I gradually understood the concept already.
thanks a lot