Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why are these iptables rules preventing me from browsing the net?

iptables -A INPUT -i eth0 -p tcp --dport 30000:60000 -m state --state NEW,ESTABLISHED -j DROP
iptables -A OUTPUT -o eth0 -p tcp --sport 30000:60000 -m state --state ESTABLISHED -j DROP

With iptables -F you can clear the iptables rules in case you can not browse the net after trying those rules.

I'm using Ubuntu 12.04 but I see this also on my Debian server.

share|improve this question
    
Just a note: these would prevent most TCP/IP clients from working to connect to anyplace on the Internet. There's nothing special about a web browser, these are baked into TCP/IP. You just noticed cause you're using a browser, not say, IRC. – Rich Homolka Sep 25 '12 at 20:59
    
I actually noticed this while trying to create iptables rules for my server so that I just allow connections to the ports that are really needed. I soon noticed that I needed to open ports somewhere between 30000 and 60000 or Oauth (using Omniauth) would not work at all. Since applying iptables rules I saw random errors in the logs. Now I know those errors came when Oauth tried to use the closed ports 60000 to 61000. – Mika Sep 25 '12 at 21:09
up vote 8 down vote accepted

The web browser needs a port for each HTTP request. Those ports are (rarely) chosen by the browser, but by the kernel. The kernel doesn't look at ipfilter rules, it only tries to use a free port. And most of the time the ports between 30000 and 60000 are used.

To see which port range your kernel is trying to use:

cat /proc/sys/net/ipv4/ip_local_port_range

You can change those values with:

echo 1234 5678 >/proc/sys/net/ipv4/ip_local_port_range   # for immediate effect

or edit the /etc/sysctl.conf file to keep the settings across reboots.

Edit: as @TomWijsman suggests, the default values are:

echo 32768 61000 >/proc/sys/net/ipv4/ip_local_port_range
share|improve this answer
7  
(In case someone messes them up trying, good defaults are 32768 61000) – Tom Wijsman Sep 25 '12 at 19:51
    
Thank you :) This clarifies a lot. – Mika Sep 25 '12 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .