I made default policy of my machine-


INPUT channel has been blocked. Now I want to allow only some specific services like I should be able to access the internet. So what rule should I add? Port 80 is for HTTP so I tried allowing that port by

iptables -A INPUT -p tcp --dport 80 ACCEPT

But it didn't work. Let me know how can I do this?

1 Answer 1


iptables rules are sequential, meaning the first rule they hit that matches gets executed. rules like ACCEPT, DROP, and REJECT are terminal, meaning the packet will not proceed further into the chain.-A means append. So what you've done is

  • match everything and REJECT it # everything stops here
  • accept tcp port 80 # we never reach this because everything stopped there ^

unfortunately tcp port 80 is part of everything, and thus you never reach your second rule. Flush your INPUT chain with -F and reverse the order in which you run your rules. I also recommend reading Dan Robbins article on stateful firewall design which is not just for gentoo or 2.4 kernels.

  • I flushed the rule and after that I put these rules, why doesn't iptables -A INPUT -p tcp --sport 80 -j ACCEPT; iptables -A INPUT -j DROP working? Commented Sep 11, 2011 at 5:10
  • because http requests are not being sent from port 80, even if they are requested to that port? if you're trying to block your internet requests I suggest blocking outbound port 80 and if you're trying to block your webserver from an external you'll want to use --destination-port( --dport ) 80 Commented Sep 11, 2011 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .