I can only make assumptions, because, you haven't listed your default policies. Found at the top of the output of
iptables -S. I'll assume you're being restrictive and you have something like this.
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
Great! Your machine is now completely invisible, blindfolded, bound and gagged with respect to IP packets. This is as almost as good as unplugging it from your Ethernet network.
So if you want to have hope in this cruel, dark world, you'll have to put some rules in place to accept some packets, maybe meet someone with a knife to cut your ropes with, but which packets are the right ones?
An output rule is needed to allow packets to reach ports the servers use for http/https traffic
-A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
An INPUT rule is needed to allow packets in to your browser from ports used for http/https traffic.
-A INPUT -p tcp -m multiport --sports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT
So now you can ESTABLISH NEW http/https connections from your web browser, and receive information coming back through those ESTABLISHED connections.
What's the problem then? There is no way to get DNS information, you should be able to enter the ip address of websites you want to visit into your web browser, but that's not exactly what we want. DNS traffic is handled over port 53 with the UDP protocol.
-A OUTPUT -p udp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
And to receive those handy replies, we'll need to cut some more holes in that blindfold.
-A INPUT -p udp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT
Now there is some light, you can hear it, say if you make a dns query to one of google's servers
dig @184.108.40.206 slashdot.org
Such response! But maybe your browser still can't figure out where slashdot really is in the world. At least one distribution (Ubuntu) is setup to use an internal DNS proxy so you'll need to be able to talk to yourself (the rest of the world is boring anyway) by setting up rules to allow you to communicate as a server on port 53
-A OUTPUT -o lo -p udp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A INPUT -i lo -p udp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
Notice the subtle difference between these, "I'm my own server" rules, and the previous, "I just want to see the world rules". Also
-o lo and
-i lo indicate that this server will only serve this machine, a good measure to avoid being sucked into some complicated DNS bounce type attack.
You should now see that you're browser works again.