I am trying to setup firewall rules on a RHEL webserver, so that my webserver can serve up web pages and at the same time download remote files using curl/wget. Problem I am experiencing is I can only do one or the other. I've tried tweaking my iptables settings and I isolated the problem to be with outbound packets cause if I enable all outgoing, it works just fine.

This is what I am using:

iptables -A INPUT -p tcp -m tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --syn --dport 22 -m connlimit --connlimit-above 3 -j DROP
iptables -A OUTPUT -p tcp -m tcp --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp -m tcp -m multiport --sports 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT -p udp -m udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

Could it be something to do with ESTABLISHED,RELATED in my OUTPUT rule for http/https?

  • 1
    Yes it could be... Do you expect all the possible outgoing connections to somehow magically be already established? Or do you want to initiate NEW outgoing connections, in addition established connections? – Zoredache Apr 6 '14 at 6:32

You prettly clearly dropped all your output packets that don't match any of the rules:

iptables -P OUTPUT DROP

And at the same time you didn't accept any packets that constitute new connections and instead all your rules operate only on established connections that can never actually be established:

iptables -A OUTPUT ... -m state --state ESTABLISHED,RELATED ...

Please read the manual page for iptables and especially the part describing -m state. Then you won't create firewalls that explicitly block your new outgoing connections and then be surprised that your outgoing connections are being blocked.

I, personally, don't think it's a good idea to use the DROP policy on INPUT and OUTPUT chains and I don't care about its usage on the FORWARD chain. I always use explicit REJECT/DROP rules at the and of the chain. REJECT is usually better for the beginning as it doesn't introduce lags and timeouts.

The best solution for you is probably to switch the OUTPUT policy back to ACCEPT and remove the OUTPUT rules.

  • Yeah that was it. But it instead of changing the default OUTPUT to accept, I decided to explicitly allow outgoing new,established rules for http/https traffic with the following: iptables -A OUTPUT -p tcp -m tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED -j ACCEPT and iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT – Python Novice Apr 6 '14 at 14:53
  • @PythonNoob: That's a valid approach as well, if you want to control OUTPUT carefully, which is not so common. – Pavel Šimerda Apr 6 '14 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.