Purely as an academic exercise in an attempt to simply learn, I have been playing with iptables. Spent a few days on this so far and I think I now have a good understanding of how it all works. I started with only changing settings on the INPUT chain and I can now accept/deny pretty much anything I need. ssh access for example.
I then moved on to 'playing' with the OUTPUT chain and, whilst I think I understand what I'm doing, I must be missing something somewhere. Here is what I am trying to do (simply as a learning excercise).
Block all incoming requests, block all outgoing requests, then manually enable them one by one. Thought I would test it with http web access and I can't get it working.
I am using webmin to configure iptables but I am happy to use a shell as well.
INPUT chain : Default to block. Enable TCP to destination port 80 for NEW and ESTABLISHED connections. Enable TCP to destination port 53 for NEW and ESTABLISHED connections.
OUTPUT chain : Default to block. Enable TCP from source port 80 for NEW connections. Enable TCP from source port 53 for NEW connections.
I am thinking this way, I can browse the interweb (not HTTPS I know) as long as I initiate the connection.
As I say I'm just trying to understand a little more about iptables and network traffic in general.
Any pointers as to what I am doing wrong would be welcome.
P.S. I'm a Windows convert .... be gentle !