2

I have installed ubuntu desktop 20.04 and i want to setup an iptables whitelist, both for INPUT and OUTPUT so not only websites are whitelisted, but also all connections that might be initiated from installed programs. The ubuntu desktop is using the internet connection of a tethered android phone.

I setup the whitelist you can see below.

  • It blocks all not whitelisted ips

  • it can open a whitelisted http website in browser

  • it can ping any whitelisted website in cli, both http and https

  • it cant open a whitelisted https website though

    ip6tables --policy INPUT   ACCEPT;
    ip6tables --policy OUTPUT  ACCEPT;
    ip6tables --policy FORWARD ACCEPT;
    ip6tables -Z; 
    ip6tables -F; 
    ip6tables -X; 
    iptables --policy INPUT   ACCEPT;
    iptables --policy OUTPUT  ACCEPT;
    iptables --policy FORWARD ACCEPT;
    iptables -Z; 
    iptables -F; 
    iptables -X; 
    
    #this allows pinging the whitelisted http or https website
    iptables -A INPUT -s 127.0.0.53 -j ACCEPT
    iptables -A OUTPUT -d 127.0.0.53 -j ACCEPT
    
    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    iptables -A INPUT -i lo -j ACCEPT
    iptables -A OUTPUT -o lo -j ACCEPT
    
    #whitelisted ip
    iptables -A INPUT -s 193.99.144.80 -j ACCEPT
    iptables -A OUTPUT -d 193.99.144.80 -j ACCEPT
    iptables -A FORWARD -d 193.99.144.80 -j ACCEPT
    
    iptables -P INPUT DROP
    iptables -P OUTPUT DROP 
    iptables -P FORWARD DROP
    

How would i need to change the setup so that i can open whitelisted https websites in browser? Could it be that the problem is because im using an android internet connection connected with usb instead of ethernet?

  • When you attempt to go to an HTTPS site what do you see/get in an error message from the browser? – Thomas Ward Jun 18 at 15:41
  • Thomas, it says that it cant reach that server and that the address is correct but i should check my network. – jayden Jun 19 at 7:02
1

Solved it. The ip i tried to whitelist made some problems, dont know what exactly. but the following whitelist seems to work with other ips. Note that some websites require additional services like cdn or jquery etc to run.

#start fresh
iptables --policy INPUT   ACCEPT;
iptables --policy OUTPUT  ACCEPT;
iptables --policy FORWARD ACCEPT;

iptables -Z; # zero counters
iptables -F; # flush (delete) rules
iptables -X; # delete all extra chains

#this seems to be essential for dns
iptables -A INPUT -s 192.168.42.129 -j ACCEPT
iptables -A OUTPUT -d 192.168.42.129 -j ACCEPT

#whitelisted domain
iptables -A INPUT -s 77.247.84.129 -j ACCEPT
iptables -A OUTPUT -d 77.247.84.129 -j ACCEPT

# drop the rest
iptables -P INPUT DROP
iptables -P OUTPUT DROP 
iptables -P FORWARD DROP`enter code here`
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.