iptables configuration

Question

I'm trying to setup iptables, the forward rules are workin fine, but the output rules are making problems.

I Can't access internet from the hosts beheind the firewall neither the firewall server can ping www.google.com . And the hosts can't ping www.google.com too, the ping didn't worked with ip too.

The default action for input, output and forward is drop.

I've opened 80,443,53(tcp and udp) and the ports for outlook.

Here my output rules:

iptables -P OUTPUT DROP

# Output
iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -p udp --dport 53 -j ACCEPT


# DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

Answer 1

Here, in your FORWARD chain, you allow some outgoing traffic. Although it can't come back, you should use the conntrack machine to allow this behavior in FORWARD chain for the LAN machines, and in the INPUT chain for the router.

You haven't allow ICMP too, so ping can't pass.
One more thing : I would specify an interface in FORWARD chain. If you don't, your ports could be exposed, or machine could be used as a gateway by an external machine.

Let's rewrite your rules accordingly (replace eth1 with your LAN interface) :

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# Forward - WAN to LAN
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Forward - LAN to WAN
iptables -A FORWARD -i eth1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp --dport 25 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp --dport 110 -j ACCEPT
iptables -A FORWARD -i eth1 -p tcp --dport 53 -j ACCEPT
iptables -A FORWARD -i eth1 -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -i eth1 -p icmp -j ACCEPT

# Input
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Output
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT

Edit: specify eth1 as advised in the comments.