Allow downloading through iptables

Question

I use iptables on Centos 7 but i cant update or install packets while iptables is enabled. Which port must be accepted in iptables to allow yum update/install ?

Answer 1

yum uses TCP port 80 by default. You can add a rule into IP tables like this:

# iptables -I INPUT 5 -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

If needed, change your interface from eth0 to em0. Make sure that rule you added is above your reject rule.

Sources:

https://www.centos.org/forums/viewtopic.php?t=30338

http://www.binarytides.com/open-http-port-iptables-centos/

Answer 2

If your policy is drop, then you need to add these rules.

as a user with privileges:

modprobe conntrack

iptables -I INPUT 6 -p tcp -m tcp --sport http -m conntrack --ctstate ESTABLISHED -j ACCEPT -m comment --comment "http input port 80"

iptables -I OUTPUT 6 -p tcp -m tcp --dport http -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -m comment --comment "http output port 80"

HTTP means port (80)

comments allow you to identify the rules on IPtables.

Answer 3

Added these rules and always blocked when i try update/install :

iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT iptables -t filter -A OUTPUT -p tcp --sport 80 -j ACCEPT

Have you an idea ?

Answer 4

Recently added some rules for ports 53,80,443 but i still cannot update/install. Heres the script i use to set the rules :

#!/bin/sh

# flush all
iptables -t filter -F
iptables -t filter -X

# Deny i/o
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

# Established co
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

# ICMP
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A OUTPUT -p icmp -j ACCEPT

# SSH
iptables -t filter -A INPUT -p tcp --dport 666 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 666 -j ACCEPT

# DNS
iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 53  -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --sport 53 -j ACCEPT

# FTP
iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 20:21 -j ACCEPT

# HTTP/S
iptables -t filter -A INPUT -p tcp --dport 80:443 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --sport 80:443 -j ACCEPT