1

I'm trying to setup iptables, the forward rules are workin fine, but the output rules are making problems.

I Can't access internet from the hosts beheind the firewall neither the firewall server can ping www.google.com . And the hosts can't ping www.google.com too, the ping didn't worked with ip too.

The default action for input, output and forward is drop.

I've opened 80,443,53(tcp and udp) and the ports for outlook.

Here my output rules:

iptables -P OUTPUT DROP

# Output
iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -p udp --dport 53 -j ACCEPT


# DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
  • 3
    Well, as there is no OUTPUT rule allowing anything but DNS, it's normal the firewall cannot access anything nor ping google. Actually you have no rules allowing icmp anywhere, so ping is not allowed for hosts either. – spectras Jun 9 '16 at 4:58
  • 1
    You also need rules to accept ports in the incoming INPUT chain. I recommend using a stateful firewall using the conntrack module as it is much simpler to configure. – rda Jun 9 '16 at 8:09
  • 1
    Please clarify your question, what your goal is. – rda Jun 9 '16 at 8:10
2

Here, in your FORWARD chain, you allow some outgoing traffic. Although it can't come back, you should use the conntrack machine to allow this behavior in FORWARD chain for the LAN machines, and in the INPUT chain for the router.

You haven't allow ICMP too, so ping can't pass.
One more thing : I would specify an interface in FORWARD chain. If you don't, your ports could be exposed, or machine could be used as a gateway by an external machine.

Let's rewrite your rules accordingly (replace eth1 with your LAN interface) :

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Forward - WAN to LAN
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Forward - LAN to WAN
iptables -A FORWARD -i eth1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -i eth1 -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -i eth1 -p icmp -j ACCEPT

# Input
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Output
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT

Edit: specify eth1 as advised in the comments.

  • You're right, it's done. – Sanael Jun 9 '16 at 11:41
  • I did the test but the firewall machine and the pcs behind it cant access internet – lipesmile Jun 10 '16 at 20:02
  • What are your interfaces name and which one are connected to the LAN and WAN? – Sanael Jun 10 '16 at 20:05
  • Forgot my last comment it worked, thank you ;) – lipesmile Jun 10 '16 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.