0

I never had issues with Debian 7 using iptables. However, with Debian 8, I cannot get iptables to work at all.

Simple script like this takes several minutes to load and can't access my portal page.

#!/bin/bash

# Delete existing rules
iptables -F

# Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Outbound DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT

# Portal
iptables -A INPUT -p tcp --dport 8443 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 8443 -j ACCEPT

# Logging
iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A LOGGING -m limit --limit 12/min -j LOG --log-prefix "eh: " --log-level 7
iptables -A LOGGING - DROP

I get a bunch of iptable logs that can't access port 8443. I have 3 NIC's on the server, all virtual from ESXi 6.0. Without iptables, I can access the web, visit portal page, etc. No issues.

I tried specifying the eth0 in the iptables and that didn't help either.

1

you are not adding rule for NEW , RELATED,ESTABLISHED . in previous version it may be it was allowing by default without adding or you have added. in this case you have to add rule . first delete all rule using :

iptables -F
iptables -X

then add rule :

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state NEW -j ACCEPT

and run your script . it will work if not then put output of sudo iptables -vnL

  • Hmm, let me try adding the state to each line and see if that helps. – debip71x Jul 26 '15 at 3:32
  • Made no difference – debip71x Jul 26 '15 at 5:26
  • try to put option NEW , ESTABLISHED , RELATED with iptables -A INPUT -p tcp --dport 8443 -j ACCEPT – pl_rock Jul 26 '15 at 6:19
  • check your gateway is ok . do debugging like first remove drop output rule and check . also try to refresh page and see no. packet is increasing or not on port 8443 in command " iptables -vnL " if yes , then your connection request is coming to server but it is not responding . iptables is very critical topic many problem occurs . best of luck – pl_rock Jul 26 '15 at 6:29
  • Got it working. I realized I had two gateways setup. – debip71x Jul 26 '15 at 7:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.