IP tables for home use

Question

I've been trying to set up rules for a desktop I have in my home network and even though at first this configuration worked, I changed something somewhere and now it won't pass any kind of connection. This script runs with system startup.

#!/bin/bash   

### Variables ###
LAN="eth0"
WLAN="wlan0"
iptables="/sbin/iptables"
ip6tables="/sbin/ip6tables"
ssh_port=50000


### Initial set up ###
clear
# echo -e "\n"


### Flush ###
$iptables -F
$iptables -X
$iptables -Z
echo "Rules flushed; tables are empty now" && echo ""    


### Basic rules ###
$iptables -A INPUT -s 127.0.0.1 -j ACCEPT
$iptables -A OUTPUT -s 127.0.0.1 -j ACCEPT
$iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
echo "Basic rules written"&&echo""


### Special rules ###
# slsk
$iptables -A INPUT -p tcp --dport 63922 -j ACCEPT
$iptables -A INPUT -p tcp --dport 63923 -j ACCEPT
$iptables -A INPUT -p tcp --dport 2416 -j ACCEPT
# mpd
$iptables -A INPUT -p tcp --dport 8800 -j ACCEPT
$iptables -A INPUT -p udp --dport 8800 -j ACCEPT
# allow pings 
$iptables -A INPUT -p icmp -m state --state NEW -j ACCEPT
# ssh server
$iptables -A INPUT -p tcp --dport $ssh_port -j LOG
$iptables -A INPUT -p tcp --dport $ssh_port -j ACCEPT
#$ip6tables -A INPUT -p tcp --dport $ssh_port -j LOG
#$ip6tables -A INPUT -p tcp --dport $ssh_port -j ACCEPT
echo "Special rules set" && echo ""


#### Default policies ###
$iptables -A INPUT -j DROP
$iptables -A OUTPUT -j ACCEPT
$iptables -A FORWARD -j DROP 
echo "Default policies set" && echo ""


echo "Firewall set up finished" && echo ""

Is anything wrong? How can I troubleshoot it?

--- edit --- In response to Alexander Chen

This is an extract of the log after adding the log rule (ub is my computer name):

May 12 18:37:19 ub kernel: [30205.793422] iptables denied: IN=wlan0 OUT= MAC=e8:de:27:07:1f:d6:64:d9:54:c2:d0:ec:08:00 SRC=212.89.0.77 DST=192.168.1.3 LEN=175 TOS=0x00 PREC=0x00 TTL=250 ID=43075 DF PROTO=UDP SPT=53 DPT=27334 LEN=155

### Basic rules ###
[...]
#### Default policies ###
$iptables -A INPUT -j LOG --log-prefix "iptables denied: " --log-level 7
$iptables -A INPUT -j DROP
$iptables -A OUTPUT -j ACCEPT
$iptables -A FORWARD -j DROP 
echo "Default policies set" && echo ""

This is how I have the configuration file right now after trying again with the little UDP fix. Before using the log rule it still wouldn't allow traffic, but after adding it before the drop rule seems to work alright, even though I can't ping anything from command line (and so I guess a lot of stuff is going to give me some headaches). I'm going to keep testing some stuff. Edit* yeah, it doesn't work; at first it doesn't seem to work, then it does and finally it goes off again. Should I post the whole log?

Answer 1

The error message in the kernel logging is telling you that an inbound UDP packet to your port 53 was dropped.

Looking at your configuration there is nothing that tells the firewall to accept UDP. (You've got a rule to accept established and related TCP connection packets, but nothing for UDP.)

The solution is to remove the restriction on established and related packets for TCP so that it applies to UDP too:

$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Answer 2

It looks like you haven't allowed UDP connections in, thus blocking DNS on UDP port 53.

If you are using DHCP, then you'll also need to allow DHCP on UDP ports 67-68 as well.

Add the following two lines and it should connect:

$iptables -A INPUT -p udp --dport 67:68 -j ACCEPT
$iptables -A INPUT -p udp --dport 53 -j ACCEPT

There may be other ports on udp you might need to open depending on what else is running.