1

Following is my iptables rules in Ubuntu.

╰─$ sudo iptables -S              
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -j DROP

Only for the INPUT, I have given rules and all outgoing traffic are in ACCEPT policy. But I can not browse internet or ping to any internet domain.

But, if I remove the last rule in INPUT chain -A INPUT -j DROP then I can browse and ping.

What chain exactly need to be opened for browsing internet? Why the INPUT chain policy is interfering with outgoing traffic. I am confused. Explanation please.

1

The -A INPUT -j DROP negates your -P INPUT ACCEPT. -j is the jump option, which as far as I understand, means if a packet matches this rule, the firewall will ignore all the other rules about the packet, and do whatever this line says to do with the packet, which in this case, is DROP.

This is letting you send a ICMP signal out, or make an HTTP request, but it is dropping any responses you get. If there is some input you are trying to filter, you would need to add more specificity to the rule, or it will continue to drop everything your outgoing requests get back.

This is my favourite IPTables tutorial. It has several examples of filtering certain types of input, and also explains the distinction between NEW and ESTABLISHED traffic.

http://www.thegeekstuff.com/2011/06/iptables-rules-examples/

hope this helps.

  • I added another rule to accept ESTABLISHED,RELATED connections. Now it works. – Muneer Aug 26 '14 at 8:16
  • -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT – Muneer Aug 26 '14 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.