Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 4 down vote favorite
1

Why are these iptables rules preventing me from browsing the net?

iptables -A INPUT -i eth0 -p tcp --dport 30000:60000 -m state --state NEW,ESTABLISHED -j DROP
iptables -A OUTPUT -o eth0 -p tcp --sport 30000:60000 -m state --state ESTABLISHED -j DROP

With iptables -F you can clear the iptables rules in case you can not browse the net after trying those rules.

I'm using Ubuntu 12.04 but I see this also on my Debian server.

share|improve this question
Just a note: these would prevent most TCP/IP clients from working to connect to anyplace on the Internet. There's nothing special about a web browser, these are baked into TCP/IP. You just noticed cause you're using a browser, not say, IRC. – Rich Homolka Sep 25 '12 at 20:59
I actually noticed this while trying to create iptables rules for my server so that I just allow connections to the ports that are really needed. I soon noticed that I needed to open ports somewhere between 30000 and 60000 or Oauth (using Omniauth) would not work at all. Since applying iptables rules I saw random errors in the logs. Now I know those errors came when Oauth tried to use the closed ports 60000 to 61000. – Mika Sep 25 '12 at 21:09

1 Answer

up vote 7 down vote accepted

The web browser needs a port for each HTTP request. Those ports are (rarely) chosen by the browser, but by the kernel. The kernel doesn't look at ipfilter rules, it only tries to use a free port. And most of the time the ports between 30000 and 60000 are used.

To see which port range your kernel is trying to use:

cat /proc/sys/net/ipv4/ip_local_port_range

You can change those values with:

echo 1234 5678 >/proc/sys/net/ipv4/ip_local_port_range   # for immediate effect

or edit the /etc/sysctl.conf file to keep the settings across reboots.

Edit: as @TomWijsman suggests, the default values are:

echo 32768 61000 >/proc/sys/net/ipv4/ip_local_port_range
share|improve this answer
6  
(In case someone messes them up trying, good defaults are 32768 61000) – Tom Wijsman Sep 25 '12 at 19:51
Thank you :) This clarifies a lot. – Mika Sep 25 '12 at 20:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.