Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I made default policy of my machine-

iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL

INPUT channel has been blocked. Now I want to allow only some specific services like I should be able to access the internet. So what rule should I add? Port 80 is for HTTP so I tried allowing that port by

iptables -A INPUT -p tcp --dport 80 ACCEPT

But it didn't work. Let me know how can I do this?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

iptables rules are sequential, meaning the first rule they hit that matches gets executed. rules like ACCEPT, DROP, and REJECT are terminal, meaning the packet will not proceed further into the chain.-A means append. So what you've done is

  • match everything and REJECT it # everything stops here
  • accept tcp port 80 # we never reach this because everything stopped there ^

unfortunately tcp port 80 is part of everything, and thus you never reach your second rule. Flush your INPUT chain with -F and reverse the order in which you run your rules. I also recommend reading Dan Robbins article on stateful firewall design which is not just for gentoo or 2.4 kernels.

share|improve this answer
    
I flushed the rule and after that I put these rules, why doesn't iptables -A INPUT -p tcp --sport 80 -j ACCEPT; iptables -A INPUT -j DROP working? –  Chankey Pathak Sep 11 '11 at 5:10
    
because http requests are not being sent from port 80, even if they are requested to that port? if you're trying to block your internet requests I suggest blocking outbound port 80 and if you're trying to block your webserver from an external you'll want to use --destination-port( --dport ) 80 –  xenoterracide Sep 11 '11 at 6:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.