I thought the following was necessary was necessary for outgoing HTTP on a desktop (non-server):
iptables -A INPUT -p tcp -m multiport --sports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
But, it turns out I need these two to make it work. I don't know why:
iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT
I know the last rule allows UDP to the
But, I thought all I needed was
outgoing TCP for NEW/ESTABLISHED connections +
incoming TCP for ESTABLISHED connections. It seemed counter-intuitive to me (because I'm still learning).