3

I made default policy of my machine-

iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL

INPUT channel has been blocked. Now I want to allow only some specific services like I should be able to access the internet. So what rule should I add? Port 80 is for HTTP so I tried allowing that port by

iptables -A INPUT -p tcp --dport 80 ACCEPT

But it didn't work. Let me know how can I do this?

6

iptables rules are sequential, meaning the first rule they hit that matches gets executed. rules like ACCEPT, DROP, and REJECT are terminal, meaning the packet will not proceed further into the chain.-A means append. So what you've done is

  • match everything and REJECT it # everything stops here
  • accept tcp port 80 # we never reach this because everything stopped there ^

unfortunately tcp port 80 is part of everything, and thus you never reach your second rule. Flush your INPUT chain with -F and reverse the order in which you run your rules. I also recommend reading Dan Robbins article on stateful firewall design which is not just for gentoo or 2.4 kernels.

  • I flushed the rule and after that I put these rules, why doesn't iptables -A INPUT -p tcp --sport 80 -j ACCEPT; iptables -A INPUT -j DROP working? – Chankey Pathak Sep 11 '11 at 5:10
  • because http requests are not being sent from port 80, even if they are requested to that port? if you're trying to block your internet requests I suggest blocking outbound port 80 and if you're trying to block your webserver from an external you'll want to use --destination-port( --dport ) 80 – xenoterracide Sep 11 '11 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.