0

Hi guys i have the follwoing iptables file for my ubuntu 12.04 server. ITs a bit messy because i tried different ways to fix it but the problem is it doesnt allow apt commands such as apt-get to run. It shows connecting to archive.ubuntu.com and the connection times out. I guess it has something to do with the outgoing rules but im not sure. The exact same issue appeared with using UFW too. Can you please advice me as to how to fix/improve my iptables structure or maybe a fix for UFW to work. Thanks!

UPDATED::


 Completed on Mon May 14 23:09:19 2012
# Generated by iptables-save v1.4.12 on Mon May 14 23:09:19 2012
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied" --log-level 7
-A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -i lo -j ACCEPT
COMMIT
# Completed on Mon May 14 23:09:19 2012
Improve this question
1
  • Are you sure you only want to accept 127.0.0.1/32? The whole 127.0.0.0/8 net is your localhost. This is a common misconception BTW.
    – jippie
    May 14, 2012 at 20:35

2 Answers 2

Reset to default
1

You have redundant rules, all OUTPUT rules (A OUTPUT) are redundant due to the -A OUTPUT -j ACCEPT rule ("accept all outgoing traffic"). This rule itself is unnecessary if you set the OUTPUT policy to ACCEPT instead of DROP ("accept all outgoing traffic if no rule match" vs "ignore/drop all outgoing traffic if no rule match"). To set the policy, use:

:OUTPUT ACCEPT

(the counters are not necessary and have been removed as well). Since your OUTPUT chain is fine, have a look at your input chain. I see no obvious issues, the line that allows existing TCP connections (including handshake packets) and DNS responses are present:

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

As a debugging aid, I suggest you to use the -v (--verbose) flag for rule match counters. My favorite for having statistics, updated every second:

sudo watch -n1 iptables -vnL

It could be an issue that is not related to iptables. Perhaps your routing tables are wrong, DNS servers are invalid or upstream routers blocks your traffic.

Related:

Improve this answer
4
  • I miss 443 (https) for outgoing connections. This shouldn't matter though because of the -A OUTPUT -j ACCEPT rule, but you wrote you've been experimenting. You can check iptables -vnL to see which rules are hit or you can use the LOG destination.
    – jippie
    May 14, 2012 at 20:39
  • Thanks for the info but i tried everything written in both posts, my current iptables look like that (i updated my post). I also used the watch command the problem is with the INPUT, input packets get blocked when I use apt-get update for example. Logs also dont work, or at least not blocked info in either kern.log or iptables.log . Any ideas? Im using OpenVZ VPS btw if that makes any difference ?
    – feribg
    May 15, 2012 at 3:23
  • @feribg Where do they get blocked (at what rule?). The order of rules is important, your -j LOG line does not make sense at that position as there are still rules below that. Are you able to curl/wget other websites? What is exactly the output of apt? Perhaps it's a wrongly configured proxy.
    – Lekensteyn
    May 15, 2012 at 12:43
  • Hi, I have no idea at what rule they get blocked it only increases the number of dropped packages in the INPUT chain doesnt show anything else. CURL doesnt work. apt, curl and everything else works perfect without iptables, so the issue is clearly in some of my input rules but i have no idea on which ...
    – feribg
    May 16, 2012 at 21:36
0

I think the easiest way to figure this out is to flush all the rules and re-add them one by one until it stops working. Mind you that if you're doing this from a remote, that your default DROP policy can disconnect you when you blindly flush / zero all rules.

Improve this answer
2
  • ...and to flush all rules, use sudo iptables -F. Note that the policies are not restored, therefore you must also use: sudo iptables -P INPUT ACCEPT; sudo iptables -P OUTPUT ACCEPT. Failing to do so may lead you to block all network traffic, both ingoing and outgoing.
    – Lekensteyn
    May 14, 2012 at 21:03
  • I tried the problem seems to be somewhere in the INPUT rules but they look fine to me ?
    – feribg
    May 15, 2012 at 3:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .