Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm trying to setup a iptables which only allows traffic in via ssh and a catch all that blocks everything else coming into computer. The iptables -L output looks like this

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

The above appears to block anything coming into the computer except for SSH, however, it also seems to block returning traffic from an outgoing request. i.e. if I try to ping www.google.com it seems to time trying to resolve DNS. I'm assuming my DROP all blocking the response from the DNS request.

Can anyone direct me how to setup the catch-all correctly to allow returning traffic back in?

Thank you,

Matthew

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Use -m state --state ESTABLISHED,RELATED to match returning traffic. Also, you don't have to include a "drop all" rule, just change INPUT's chain policy to "DROP".

sudo iptables -F INPUT
sudo iptables -P INPUT DROP
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.