Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

My Server OS: Centos 6.3 x64.

The server iptables is:

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
COMMIT

But I get neither a response issuing

ping www.google.com

OR

curl -I http://www.google.com

from the server. Both receive no response!

How to modify my iptables rules?

share|improve this question

closed as unclear what you're asking by bersch, slm Jul 2 at 10:34

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
what's output this command? cat /etc/resolv.conf –  Babyy Jul 2 at 10:02
    
@Babyy see iptables-save –  user55518 Jul 2 at 10:11
    
@ikool: please provide output of your ping cmd. Your rules allow connect to your machine on ports 22, 80. To check if the ports are open use nc -v -z host 80. –  user55518 Jul 2 at 10:14
    
@Babyy cat /etc/resolv.conf 8.8.8.8 –  ikool Jul 2 at 14:30

2 Answers 2

up vote 0 down vote accepted

You didn't give many details about your network setup, but assuming that the iptables configuration is on host "A" and you tried to ping from host "B", then here's the answer.

You configured iptables to allow TCP ports 22 and 80. All other traffic is blocked because iptables interprets the configuration from the top and you have

:INPUT DROP [0:0]

set.

ICMP is a different protocol, and you have to explicitly allow it in order to be able to ping the machine:

iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -d YOUR_IP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


EDIT: your edit in the original question showed that you are trying to access hosts from the host you've configured iptables. So you have to tell iptables to accept packets that are part of an existing connection:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this answer

You should allow udp port 53 for name resolution and icmp echo for ping test

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.