Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've gone through numerous trial and error to recently discover that my iptables result is the culprit of blocking all LAN and WAN activity. I know this, because if I comment out the last line in my interfaces fill - shown below - I can have usual LAN and WAN access. However, if I do not, I can ping my router, any other node or any unresolved domains.

I doubled check to see if it was the iptables ruleset, by performing iptables-restore < /etc/iptables.rules. Therefore, this demonstrates the last line in the interfaces file is legal, furthermore confirming that my errors aren't a result of the misuse of the interfaces file.

auto lo
iface lo inet loopback

auto em1
iface em1 inet static

pre-up iptables-restore < /etc/iptables.rules

What is it about my ruleset that is causing such restrictive network access?

# Generated by iptables-save v1.4.21 on Sat May  3 01:24:30 2014
:OUTPUT ACCEPT [491:1788008]
:sshguard - [0:0]
-A INPUT -j sshguard
-A INPUT -p tcp -m tcp --dport 1019 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 8112 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 58846 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 62598 -j ACCEPT
-A INPUT -s -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -s -p tcp -m tcp --dport 137 -j ACCEPT
-A INPUT -s -p tcp -m tcp --dport 138 -j ACCEPT
-A INPUT -s -p tcp -m tcp --dport 139 -j ACCEPT
# Completed on Sat May  3 01:24:30 2014
share|improve this question
up vote 1 down vote accepted

My first guess: You need connection tracking.

Without it I believe reply traffic to your requests are filtered, which is probably not what you want.

Try adding the following before your other input rules:

share|improve this answer
Before I try this, I feel I must understand it. So basically, it will allow all connections that are established, instead of strictly adhering to my current ruleset, which can be perceived as quite strict? So what makes a connection established? – adampski May 4 '14 at 20:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.