0

When resetting IPTables, the apt-get and wget command functions correctly and also downloads what I want. But once I activate this firewall, it isn't functional. Pings still work.

I want to allow all outgoing connections. That's why I added "iptables -P OUTPUT ACCEPT" at the end.

IPTables Firewall: http://pastebin.com/pTGyiz7c

iptables -L -n -v: http://pastebin.com/6Q8Mbgfh

Improve this question
6
  • OK But what is really in iptables ? Could you add the result of "iptables -L -n -v" in your question ? Commented Jan 29, 2016 at 15:10
  • Yes, I have added it. Commented Jan 29, 2016 at 15:13
  • I don't see anything concerning the established connections in your firewall in INPUT. So you will not receive the packets from the outside. You must add a log at the end and check your logs to debug your firewall Commented Jan 29, 2016 at 15:13
  • Could you post the command? Commented Jan 29, 2016 at 15:14
  • Could you do the command when the firewall is active and filtering, not disabled :-) Commented Jan 29, 2016 at 15:15

3 Answers 3

Reset to default
0

Your firewall is missing major part. The first packet go to outside correctely (as the OUTPUT policy is ACCEPT). The fist incoming packet is rejected as there is nothing allow in INPUT rule. You should have a iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT to allow the connection tracking to allow the packet to come. The second packet will be allowed to go out too as the OUTPUT policy is ACCEPT.

Add a rule to log what is reject is important. Add iptables -A INPUT -j LOG --log-prefix "DROP4 INPUT " at the end of the INPUT rule.

A remark : do you need all the opened ports in INPUT ? The mysql service opened to Internet is not really a good idea...

Improve this answer
2
  • In my Firewall, I only allow MySQL, SSH and others to be opened in the IP subnet of my servers. Everyone outside will is blocked. Commented Jan 29, 2016 at 15:44
  • Oh wait, it doesn't! Thanks for letting me know. I will edit that now. A huge thanks for helping Commented Jan 29, 2016 at 15:46
0

You need to allow incoming packets, related to your outgoing connections.

iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

If that doesn't work:

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Differences are discussed here: https://unix.stackexchange.com/questions/108169/what-is-the-difference-between-m-conntrack-ctstate-and-m-state-state

Improve this answer
0
0

basvdlei & Dom is answer is right,

iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

but, wget or apt need one more thing: DNS add below line works fine in my situation

iptables -A INPUT -p udp --dport 53 -j ACCEPT
Improve this answer

You must log in to answer this question.