Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm very new to iptables but after some searching I managed to make a basic rules file which fits my needs. Everything seems to work correctly when I load it, except that I can't make ping commands or update the software list.

Ping commands are just not send and updating the software list just gives me resolve errors. Pinging to an IP instead of an domain name gives me the same problem. I guess my problem is the answer not being allowed back in, but I have no clue how to change that. What rules do I need to allow to fix this?

Current rules file:

# Generated by iptables-save v1.4.4 on Thu Jan 23 13:43:37 2014
:PREROUTING ACCEPT [2845:252602]
:INPUT ACCEPT [2845:252602]
:OUTPUT ACCEPT [1783:205125]
# Completed on Thu Jan 23 13:43:37 2014
# Generated by iptables-save v1.4.4 on Thu Jan 23 13:43:37 2014
:INPUT DROP [277:18656]
:OUTPUT ACCEPT [1453:163247]
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p udp -m udp --dport 9987 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 10011 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 30033 -j ACCEPT
#Call of Duty Normal
-A INPUT -p tcp -m tcp --dport 28960 -j ACCEPT
#Call of Duty Graafschap
-A INPUT -p tcp -m tcp --dport 28970 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25565 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8123 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 27015 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 27005 -j ACCEPT
-A INPUT -p udp -m udp --dport 27005 -j ACCEPT
-A INPUT -p udp -m udp --dport 27015 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 990 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 4242 -j ACCEPT
# Completed on Thu Jan 23 13:43:37 2014
share|improve this question
Try adding this iptables -A INPUT -p icmp -j ACCEPT –  Mitch Feb 7 at 22:07
Thanks for your answer, but no it did not work :( –  PureTryOut Feb 7 at 22:10
add comment

1 Answer 1

I don't see anything obviously wrong if you have only one interface. Logging the dropped packets might help you discover what is happening. Adding a rule like this to the end of your rules should log the a couple of dropped packets a minute. Adjust or remove the limit if you need.

-A INPUT -m limit --limit 2/min -j LOG --log-prefix "IPTables-Dropped: " --log-level 6

I find the Shorewall documentation helps understand how to configure a firewall. Using a tool to build the firewall rather than handcrafting one tends to help avoid issues.

share|improve this answer
It says the option --log-prefix is unknown... –  PureTryOut Feb 9 at 11:03
@PureTryOut It works in my environment. Try without the log-prefix or remove the space. –  BillThor Feb 9 at 16:52
Removed the whole log-prefix option, then it complains --log-level is unknown... It seems it just doesn't want to log somehow. I thought the -j option enabled logging? –  PureTryOut Feb 10 at 9:08
@PureTryOutTry using just -j LOG. You can use the iptables command append, remove, and insert rules while testing. In reviewing the documentation, you need a LOG rule before the DROP or REJECT rule. I must have a post processor running. –  BillThor Feb 11 at 0:14
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.