3

I'm learning how to use iptables and I'm writing a very simple firewall on Ubuntu.

Using just the filter table, I added the following rules

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

as I want to let pass just the packets I desire.

Then I tried to add rules to make simple HTTP connections, and so, for a very first attempt, I added

iptables -A INPUT -p tcp -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT

the first line to accept all TCP traffic and the second to accept DNS answers.

Similarly, for the OUTPUT chain, I added

iptables -A OUTPUT -p tcp -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

But when I try to use lynx the connection doesn't take place.

I think the only problems is the DNS, since all the TCP traffic is accepted. But packets to/from port 53 can pass through the firewall ... so, where the problem is?


I added the following two rules and now it works.

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

and using Wireshark I realized that DNS requests are also to/from loopback interface. I never imagined that ... why?

1 Answer 1

1

Just use iptables-save and restart you computer. This will make your iptables settings work.

If you are setting firewall then why are you enabling all the tcp ports. I would prefer to allow selected ports only. i.e for lynx. I would use:

sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables-save
sudo init 6

Also why are you using

sudo iptables -A OUTPUT -j DROP

This will drop all your outgoing traffic from all the ports.

3
  • This is not a "real" firewall (in fact I'm running it on Ubuntu on VirtualBox), but I just want to learn how to use. I want to let pass ONLY dns and http traffic outgoing. For this reason, I added these lines on the OUTPUT chain, but they seems not to work. In addition, iptables -L -v says that all the dns outgoing packets match the rule, while all the incoming packets are dropped. Why?
    – JustTrying
    Nov 6, 2012 at 10:27
  • Have you tried the iptables-save and restarted the VM then? This will make your rule work. iptables -L -v will list all the iptables rule that you have entered. Can you attach the output of iptables -L -v you are getting?
    – s.m
    Nov 6, 2012 at 10:35
  • I explained in the first post why now it works, but I don't understand the reason ...
    – JustTrying
    Nov 6, 2012 at 10:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .