I have four interfaces on my system (eth0, eth1, eth2, and eth3). I want to block all incoming and outgoing traffic on eth2 except for port 80 and 443, although I'm only worrying about 80 right now. The IPtables commands I'm using are as follows:

/sbin/iptables -A FORWARD -i eth2 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -o eth2 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i eth2 -p tcp --dport 53 -m state --state NEW -j ACCEPT
/sbin/iptables -A OUTPUT -o eth2 -p tcp --sport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i eth2 -p udp --dport 53 -m state --state NEW -j ACCEPT
/sbin/iptables -A OUTPUT -o eth2 -p udp --sport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i eth2 -j DROP
/sbin/iptables -A FORWARD -o eth2 -j DROP

Quite simply, this isn't working. All traffic on eth2 is blocked including that on port 80. Any ideas or ways to probe for where the problem lies? I have minimal experience with IPtables so I'm not sure where to start. Thanks!

  • 1
    For one thing, you're blocking ICMP, which is an Internet host requirement and is required for TCP's path MTU detection to work. – David Schwartz Dec 14 '11 at 5:12
  • 1
    Are you trying to run a web server on this machine or access web servers from this machine? Because your firewall rules are only for incoming port 80 connections. – David Schwartz Dec 14 '11 at 5:14
  • I have another system and connects to the Internet through this one on eth2 and I only want it to be able to access incoming and outgoing ports 80 and 443, but I just want to get port 80 working before worrying about 443. As for blocking ICMP, how do I go about unblocking it? A quick Google search turned up this: cyberciti.biz/tips/linux-iptables-9-allow-icmp-ping.html Is that what you're talking about? Thank you very much! – shanet Dec 14 '11 at 5:27
  • What's the symptom? What happens if you try to telnet to from that machine? – David Schwartz Dec 14 '11 at 5:34
  • Telnet to replies with "Connected to Escape character is '^]'". And in a web browser, going directly to works, but trying google.com results in a DNS lookup error. Thus, I tried allowing port 53 as I did with port 80 above, but still no go on DNS lookups. – shanet Dec 14 '11 at 5:45

It now looks like you were allowing the traffic all along.

  • Yes, it does. I'm still having trouble letting DNS lookups through though so someone on this locked-down machine can still use a web browser as normal. I tried allowing port 53 with both TCP and UDP, and then all traffic was allowed through?? That doesn't make any sense to me. – shanet Dec 14 '11 at 5:58
  • Paste your current ruleset. – David Schwartz Dec 14 '11 at 5:59
  • I updated my original post above. The problem I'm having with the current rules is that I try to do an SSH connection, for example, from the system with only port 80 (and now 53) access and it is allowed through. – shanet Dec 14 '11 at 6:06
  • Oh! You're in the wrong chains. The INPUT and OUTPUT chains control packets to and from this machine. You want the FORWARD chain which handles packets "just passing through". – David Schwartz Dec 14 '11 at 6:17
  • 1
    It depends what traffic you're trying to control. For example, if the machine is a DNS server and you're trying to control how clients access it, then use the INPUT/OUTPUT chains. If you're trying to control how clients access other DNS servers through the machine, use the FORWARD chain. – David Schwartz Dec 14 '11 at 6:35

Consider a firewall builder like Shorewall. It will help get everything right, and can dump the rules so you can inspect them. There is extensive documentation available and example configurations for one, two, or three interfaces (external zones). This gets you three external interfaces without placing two in the same zone.

Assuming you have assigned eth2 to the zone net enabling HTTP and HTTPS can be enabled with one of these rules. Which rule you need depends on the direction you want the traffic to flow.

Web(ACCEPT)   $FW    net
Web(Accept)   net    $FW

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.