Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've gone through numerous trial and error to recently discover that my iptables result is the culprit of blocking all LAN and WAN activity. I know this, because if I comment out the last line in my interfaces fill - shown below - I can have usual LAN and WAN access. However, if I do not, I can ping my router, any other node or any unresolved domains.

I doubled check to see if it was the iptables ruleset, by performing iptables-restore < /etc/iptables.rules. Therefore, this demonstrates the last line in the interfaces file is legal, furthermore confirming that my errors aren't a result of the misuse of the interfaces file.

auto lo
iface lo inet loopback

auto em1
iface em1 inet static
      address 192.168.0.5
      netmask 255.255.255.0
      network 192.168.0.0
      broadcast 192.168.0.255
      gateway 192.168.0.1
      dns-nameservers 8.8.8.8

pre-up iptables-restore < /etc/iptables.rules

What is it about my ruleset that is causing such restrictive network access?

# Generated by iptables-save v1.4.21 on Sat May  3 01:24:30 2014
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [491:1788008]
:sshguard - [0:0]
-A INPUT -j sshguard
-A INPUT -p tcp -m tcp --dport 1019 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8112 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 58846 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 62598 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 137 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 138 -j ACCEPT
-A INPUT -s 192.168.0.0/24 -p tcp -m tcp --dport 139 -j ACCEPT
-P INPUT DROP
COMMIT
# Completed on Sat May  3 01:24:30 2014
share|improve this question

1 Answer 1

up vote 1 down vote accepted

My first guess: You need connection tracking.

Without it I believe reply traffic to your requests are filtered, which is probably not what you want.

Try adding the following before your other input rules:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this answer
    
Before I try this, I feel I must understand it. So basically, it will allow all connections that are established, instead of strictly adhering to my current ruleset, which can be perceived as quite strict? So what makes a connection established? –  adampski May 4 at 20:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.