I am configuring an iptables firewall, currently just to allow http and https traffic. It is working but under a particularly strange rule - I must allow incoming connections with a source port of 80.
That doesn't make sense to me shouldn't incoming traffic have a destination port of 80?
Below is an example of my config. If I remove the rule that allows incoming traffic on port 80 then I can't access google or anything else, active the rule and it all works. Shouldn't web servers be listening on this port and sending from a random port?
# Set all major commands to DROP by default iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP # Allow HTTP and HTTPS # Need to consider limiting to ESTABLISHED, RELATED for OUTPUT # consider NEW for INPUT # configure source ports in range 1024:65535 iptables -A INPUT -i eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT iptables -A INPUT -i eth0 -p tcp -m multiport --sports 80,443 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT # ping from inside to outside iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT # allow loopback iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Outbound DNS iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT # Logging before Drop for troubleshooting iptables -A INPUT -j LOG iptables -A INPUT -j LOG