Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am configuring an iptables firewall, currently just to allow http and https traffic. It is working but under a particularly strange rule - I must allow incoming connections with a source port of 80.

That doesn't make sense to me shouldn't incoming traffic have a destination port of 80?

Below is an example of my config. If I remove the rule that allows incoming traffic on port 80 then I can't access google or anything else, active the rule and it all works. Shouldn't web servers be listening on this port and sending from a random port?

# Set all major commands to DROP by default
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Allow HTTP and HTTPS
# Need to consider limiting to ESTABLISHED, RELATED for OUTPUT
# consider NEW for INPUT
# configure source ports in range 1024:65535

iptables -A INPUT -i eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sports 80,443 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT

# ping from inside to outside
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

# allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Outbound DNS
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT

# Logging before Drop for troubleshooting
iptables -A INPUT -j LOG
iptables -A INPUT -j LOG
share|improve this question
add comment

2 Answers

Also required is:

iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT

And the rule for DNS replies needs to be restricted to actual replies:

iptables -A INPUT -p udp -i eth0 --sport 53 -m state --state ESTABLISHED -j ACCEPT
share|improve this answer
add comment

You really need 2 rules handling ports 80 and 443, i.e. HTTP; the traffic is carried always on port 80 but you need 2 rules... The first rule allows you to send out the request for a remote page… The second rule let the answer of that request (sent by the aimed HTTP server) get back to your browser.

These are the rules

iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sports 80,443 -m state --state RELATED,ESTABLISHED -j ACCEPT 

and you should erase this rule

iptables -A INPUT -i eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.