Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm learning how to use iptables and I'm writing a very simple firewall on Ubuntu.

Using just the filter table, I added the following rules

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

as I want to let pass just the packets I desire.

Then I tried to add rules to make simple HTTP connections, and so, for a very first attempt, I added

iptables -A INPUT -p tcp -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT

the first line to accept all TCP traffic and the second to accept DNS answers.

Similarly, for the OUTPUT chain, I added

iptables -A OUTPUT -p tcp -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

But when I try to use lynx the connection doesn't take place.

I think the only problems is the DNS, since all the TCP traffic is accepted. But packets to/from port 53 can pass through the firewall ... so, where the problem is?

I added the following two rules and now it works.

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

and using Wireshark I realized that DNS requests are also to/from loopback interface. I never imagined that ... why?

share|improve this question

Just use iptables-save and restart you computer. This will make your iptables settings work.

If you are setting firewall then why are you enabling all the tcp ports. I would prefer to allow selected ports only. i.e for lynx. I would use:

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo init 6

Also why are you using

sudo iptables -A OUTPUT -j DROP

This will drop all your outgoing traffic from all the ports.

share|improve this answer
This is not a "real" firewall (in fact I'm running it on Ubuntu on VirtualBox), but I just want to learn how to use. I want to let pass ONLY dns and http traffic outgoing. For this reason, I added these lines on the OUTPUT chain, but they seems not to work. In addition, iptables -L -v says that all the dns outgoing packets match the rule, while all the incoming packets are dropped. Why? – JustTrying Nov 6 '12 at 10:27
Have you tried the iptables-save and restarted the VM then? This will make your rule work. iptables -L -v will list all the iptables rule that you have entered. Can you attach the output of iptables -L -v you are getting? – s.m Nov 6 '12 at 10:35
I explained in the first post why now it works, but I don't understand the reason ... – JustTrying Nov 6 '12 at 10:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.