Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I thought the following was necessary was necessary for outgoing HTTP on a desktop (non-server):

iptables -A INPUT  -p tcp -m multiport --sports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

But, it turns out I need these two to make it work. I don't know why:

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

I know the last rule allows UDP to the lo interface.

But, I thought all I needed was outgoing TCP for NEW/ESTABLISHED connections + incoming TCP for ESTABLISHED connections. It seemed counter-intuitive to me (because I'm still learning).

share|improve this question
    
It seems that there must be other IPtables rules in place. It could be from a firewall or a captive portal system or a number of other things. –  Shawn J. Goff Jun 29 '13 at 14:58
add comment

2 Answers

It will depend on whether or not the INPUT and/or OUTPUT chains are set to ACCEPT unmatched packets. If they are, you don't need any rules at all. If you haven't changed it this is probably the default.

Those last 2 rules allow any traffic from or to the lo interface (i.e. 127.0.0.1 / ::1), not just UDP. Unless you are connecting to a web server on the local desktop, they have no relevance to HTTP.

share|improve this answer
    
"Unless you are connecting to a web server on the local desktop...no relevance to HTTP": That's what I though too. The default policy is ACCEPT for all IN./FORW/OUT. The very last rules are -j DROP for IN./FORD/OUT. Nevertheless, there is something in the network or machine that is requires UDP packets sent to/from the loopback interface for internet access to work. I checked the logs: UDP to/from lo were dropped and that's when I could not access the internet. Internet access comes back by allowing tcp/udp/etc on the loopback interface. It's weird. –  dgo.a Jun 29 '13 at 7:42
add comment

You obviously don't need lo for Internet access. But maybe you have a local DNS server (forwarder) running. DNS uses UDP, and web access requires DNS in addition to HTTP.

Your rules do not allow (related) ICMP responses BTW. That will probably lead to problems (unless you use lowered values for MSS/MTU). But you don't even allow outgoing ICMP so that path MTU discovery would't even work.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.