Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I attempted to add a couple web ports to iptables and in doing so lost the ability to resolve any external address. I have a working SSH session open and can get to the box easily if needed.

Here's the current iptables config:

[user@boxen]# iptables --line-numbers -n -L

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 80,443 /* 100 allow http and https access */ state NEW 
2    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           multiport ports 22 /* 100 ssh 22 */ 
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
4    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

and cat /etc/sysconfig/iptables

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1:196]
-A INPUT -p tcp -m multiport --dports 80,443 -m comment --comment "100 allow http and https access" -m state --state NEW -j ACCEPT 
-A INPUT -p tcp -m multiport --ports 22 -m comment --comment "100 ssh 22" -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -j REJECT --reject-with icmp-host-prohibited 
COMMIT
# Completed on Wed Sep 25 14:20:02 2013

I can't ping the gateway or anything else. I am able to ping the gateway on another box in the same rack. I was able to ping gateway prior to my botched iptables update.

What's wrong with this config?

share|improve this question
    
Please describe exactly what you changed. –  Martin von Wittich Sep 25 '13 at 19:52
    
Please add -v to your iptables command: iptables --line-numbers -v -n -L Otherwise it doesn't list interface restrictions. –  derobert Sep 25 '13 at 19:54

1 Answer 1

up vote 4 down vote accepted

Well, you dropped all incoming traffic that is not:

  1. TCP ports 80 or 443
  2. TCP port 22
  3. From localhost

Most likely, you intended to have a rule along the lines of:

iptables -I INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

Right now your DNS replies (typically UDP source port 53) are being dropped. As are your ICMP echo replies (ping responses).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.