Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to configure my iptables to block any network traffic except HTTP:

iptables -P INPUT DROP #set policy of INPUT to DROP
iptables -P OUTPUT DROP #set policy of OUTPUT to DROP

iptables -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

The iptables output (iptables -L -v) gives me:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    4   745 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:http state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    2   330 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http state NEW,ESTABLISHED

When I try to wget 127.0.0.1 (yes i do have a web server and it works fine) i get:

--2012-11-14 16:29:01--  http://127.0.0.1/
Connecting to 127.0.0.1:80...

The request never finishes. What am I doing wrong? I'm setting iptables to DROP everything by default and add a rule to ACCEPT HTTP.

share|improve this question

2 Answers 2

I would suggest you to implement also a little protection against several types of scans and uncommon usage of the TCP protocol:

-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -m state --state INVALID -j DROP
share|improve this answer

Generally it is not a good idea to block all traffic over loopback interface. Also, you should enable ICMP on all interfaces you want them to work with IP protocols properly. The last thing that you will need most likely is DNS traffic. Also, the rule that matches states ESTABLISHED and RELATED does not need to match any port. So try the following rules set:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m udp -p udp --sport 53
iptables -A INPUT -j DROP
iptables -A OUTPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A OUTPUT -m udp -p udp --dport 53
iptables -A OUTPUT -j REJECT --reject-with icmp-host-prohibited
share|improve this answer
    
still not working, i tried it on my laptop in 3 different networks (at school, at home and via wlan tethering over my mobile phone) –  arminb Nov 14 '12 at 17:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.