0

My Server OS: Centos 6.3 x64.

The server iptables is:

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
COMMIT

But I get neither a response issuing

ping www.google.com

OR

curl -I http://www.google.com

from the server. Both receive no response!

How to modify my iptables rules?

closed as unclear what you're asking by user55518, slm Jul 2 '14 at 10:34

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • what's output this command? cat /etc/resolv.conf – بارپابابا Jul 2 '14 at 10:02
  • @Babyy see iptables-save – user55518 Jul 2 '14 at 10:11
  • @ikool: please provide output of your ping cmd. Your rules allow connect to your machine on ports 22, 80. To check if the ports are open use nc -v -z host 80. – user55518 Jul 2 '14 at 10:14
  • @Babyy cat /etc/resolv.conf 8.8.8.8 – ikool Jul 2 '14 at 14:30
1

You didn't give many details about your network setup, but assuming that the iptables configuration is on host "A" and you tried to ping from host "B", then here's the answer.

You configured iptables to allow TCP ports 22 and 80. All other traffic is blocked because iptables interprets the configuration from the top and you have

:INPUT DROP [0:0]

set.

ICMP is a different protocol, and you have to explicitly allow it in order to be able to ping the machine:

iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -d YOUR_IP -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


EDIT: your edit in the original question showed that you are trying to access hosts from the host you've configured iptables. So you have to tell iptables to accept packets that are part of an existing connection:

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
1

You should allow udp port 53 for name resolution and icmp echo for ping test

Not the answer you're looking for? Browse other questions tagged or ask your own question.