Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am configuring an iptables firewall, currently just to allow http and https traffic. It is working but under a particularly strange rule - I must allow incoming connections with a source port of 80.

That doesn't make sense to me shouldn't incoming traffic have a destination port of 80?

Below is an example of my config. If I remove the rule that allows incoming traffic on port 80 then I can't access google or anything else, active the rule and it all works. Shouldn't web servers be listening on this port and sending from a random port?

# Set all major commands to DROP by default
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Allow HTTP and HTTPS
# Need to consider limiting to ESTABLISHED, RELATED for OUTPUT
# consider NEW for INPUT
# configure source ports in range 1024:65535

iptables -A INPUT -i eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sports 80,443 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT

# ping from inside to outside
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT

# allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Outbound DNS
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT

# Logging before Drop for troubleshooting
iptables -A INPUT -j LOG
iptables -A INPUT -j LOG
share|improve this question

3 Answers 3

You write

..If I remove the rule that allows incoming traffic on port 80 then I can't access google or anything else, active the rule and it all works. Shouldn't web servers be listening on this port and sending from a random port?

No. www.google.com would send from port 80 to your random port.

Similarly, any web server you run wouldn't just listen on port 80, it would send packets with source port of 80.

And of course, your web server wouldn't be communicating with google web server.

And so whoever accesses your web server will have a random port open his end

And when you access Google you have a random port open your end.

Your confusion is in not realising that INPUT is not to do with an "incoming connection" specifically. It is all packets coming in.. including packets coming in from an outgoing connection.

So your server listening on ports 80 and 443

I'm no expert but

I'm going to give a common set up, as described in "towards the perfect ruleset" (or as used by those that point to it)

http://inai.de/documents/Perfect_Ruleset.pdf

-Allow everything out

-Allow in all established and related (related includes new connections from it such as what the old protocol FTP requires - not that you're using FTP. and it includes ICMP errors )

-Allow in all packets to your server ports.

So your policies would be

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

using -m conntrack is and --ctstate is newer than -m state and --state

And besides policies, your rules would be

iptables -A INPUT -p tcp -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 

iptables -A INPUT -p tcp -m multiport --sports 80,443 -j ACCEPT

Also that style you used and that i've written above keeping with your form, is command line style, but some might say it's more professional to use an iptables script. and a line would read -A input rather than iptables -A input. And iptables-save >file and iptables-restore < file.

share|improve this answer

Also required is:

iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT

And the rule for DNS replies needs to be restricted to actual replies:

iptables -A INPUT -p udp -i eth0 --sport 53 -m state --state ESTABLISHED -j ACCEPT
share|improve this answer

You really need 2 rules handling ports 80 and 443, i.e. HTTP; the traffic is carried always on port 80 but you need 2 rules... The first rule allows you to send out the request for a remote page… The second rule let the answer of that request (sent by the aimed HTTP server) get back to your browser.

These are the rules

iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sports 80,443 -m state --state RELATED,ESTABLISHED -j ACCEPT 

and you should erase this rule

iptables -A INPUT -i eth0 -p tcp -m multiport --dports 80,443 -j ACCEPT
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.