I attempted to add a couple web ports to iptables and in doing so lost the ability to resolve any external address. I have a working SSH session open and can get to the box easily if needed.
Here's the current iptables config:
[user@boxen]# iptables --line-numbers -n -L
Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443 /* 100 allow http and https access */ state NEW 2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport ports 22 /* 100 ssh 22 */ 3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 4 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination
and cat /etc/sysconfig/iptables
*filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1:196] -A INPUT -p tcp -m multiport --dports 80,443 -m comment --comment "100 allow http and https access" -m state --state NEW -j ACCEPT -A INPUT -p tcp -m multiport --ports 22 -m comment --comment "100 ssh 22" -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Wed Sep 25 14:20:02 2013
I can't ping the gateway or anything else. I am able to ping the gateway on another box in the same rack. I was able to ping gateway prior to my botched iptables update.
What's wrong with this config?