0

I've gone through numerous trial and error to recently discover that my iptables result is the culprit of blocking all LAN and WAN activity. I know this, because if I comment out the last line in my interfaces fill - shown below - I can have usual LAN and WAN access. However, if I do not, I can ping my router, any other node or any unresolved domains.

I doubled check to see if it was the iptables ruleset, by performing iptables-restore < /etc/iptables.rules. Therefore, this demonstrates the last line in the interfaces file is legal, furthermore confirming that my errors aren't a result of the misuse of the interfaces file.

auto lo
iface lo inet loopback

auto em1
iface em1 inet static
      address 192.168.0.5
      netmask 255.255.255.0
      network 192.168.0.0
      broadcast 192.168.0.255
      gateway 192.168.0.1
      dns-nameservers 8.8.8.8

pre-up iptables-restore < /etc/iptables.rules

What is it about my ruleset that is causing such restrictive network access?

# Generated by iptables-save v1.4.21 on Sat May  3 01:24:30 2014
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [491:1788008]
:sshguard - [0:0]
-A INPUT -j sshguard
-A INPUT -p tcp -m tcp --dport 1019 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8112 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 58846 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 62598 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 137 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 138 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 139 -j ACCEPT
-P INPUT DROP
COMMIT
# Completed on Sat May  3 01:24:30 2014
Improve this question

1 Answer 1

Reset to default
1

My first guess: You need connection tracking.

Without it I believe reply traffic to your requests are filtered, which is probably not what you want.

Try adding the following before your other input rules:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Improve this answer
1
  • Before I try this, I feel I must understand it. So basically, it will allow all connections that are established, instead of strictly adhering to my current ruleset, which can be perceived as quite strict? So what makes a connection established?
    – codaamok
    May 4, 2014 at 20:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .