0

I am using IPTables on an API server to block all incoming traffic except for SSH, HTTP and HTTPS. I need to have full access on the loopback interface to run beanstalkd amongst other things, and need outgoing http, https and SSH access for API calls to other services, as well as pulling from github.

I created the rules as follows:

iptables -F

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport http -j ACCEPT
iptables -A INPUT -p tcp --dport https -j ACCEPT
iptables -A INPUT -j DROP

iptables -L outputs:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Despite this, git pull can't find the server, pinging google doesn't work and mailgun won't send. Running iptables -F fixes these problems, and I cannot afford to have a firewall that just prevents my application from working completely...

How can I achieve what I'm trying to above?

1
  • 1
    Generally, post iptables rules using -S, not -L, as the "friendly" format omits a lot of information.
    – user1686
    Oct 18 '14 at 14:53
2

This is quite obvious when you think about it:

  • Pinging Google doesn't work because you do not have a rule that allows incoming ICMP replies.

  • Things can't "find the server" because you do not have a rule that allows DNS replies.

  • Mailgun can't talk SMTP because you do not have a rule that allows SMTP packets – the TCP SYN goes out, but the corresponding SYN/ACK gets dropped.

The general solution here is to use netfilter's connection tracking aka "conntrack" to make a rule that allows all packets that correspond to active connections:

-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

(Older documentation might have -m state; this is deprecated.)


And of course,

-A INPUT -4 -p icmp -j ACCEPT
-A INPUT -6 -p icmp6 -j ACCEPT

because why would you block that

2
  • beat me to it :) Oct 18 '14 at 14:59
  • (and just as a side note: I'm using Mailgun via API calls, not SMTP)
    – GTF
    Oct 18 '14 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.