Results 1 to 10 of 10

Thread: iptables has blocked all outgoing access

  1. #1
    Join Date
    Jun 2007
    Beans
    8

    iptables has blocked all outgoing access

    Hello,

    I have a server 10.10 and I am having issues with outbound. I have iptables rules that allow incoming traffice from certain subnets to port 80,22,3306

    However I cant ping anything from this server. Not even another machine on local network. If I iptables -F everything works as its supposed to. Can someone please help me out here.

    Chain INPUT (policy ACCEPT)
    target prot opt source destination
    ACCEPT tcp -- x.x.x.0/24 anywhere tcp dpt:ssh
    ACCEPT tcp -- x.x.x.0/24 anywhere tcp dpt:ssh
    ACCEPT tcp -- x.x.x.0/24 anywhere tcp dpt:mysql
    ACCEPT tcp -- x.x.x.0/24 anywhere tcp dpt:mysql
    ACCEPT tcp -- x.x.x.0/24 anywhere tcp dpt:www
    ACCEPT tcp -- x.x.x.0/24 anywhere tcp dpt:www
    DROP all -- anywhere anywhere

    Chain FORWARD (policy ACCEPT)
    target prot opt source destination

    Chain OUTPUT (policy ACCEPT)
    target prot opt source destination

  2. #2
    Join Date
    Jun 2007
    Beans
    8

    Re: iptables has blocked all outgoing access

    anyone????

  3. #3
    Join Date
    Feb 2007
    Beans
    185

    Re: iptables has blocked all outgoing access

    Please share output of iptables-save and netstat -nr and ifconfig

  4. #4
    Join Date
    Jun 2007
    Beans
    8

    Re: iptables has blocked all outgoing access

    sudo iptables-save
    # Generated by iptables-save v1.4.4 on Wed Mar 2 11:43:28 2011
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [8978:633207]
    -A INPUT -s x.x.x.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
    -A INPUT -s x.x.x.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
    -A INPUT -s x.x.x.0/24 -p tcp -m tcp --dport 3306 -j ACCEPT
    -A INPUT -s x.x.x.0/24 -p tcp -m tcp --dport 3306 -j ACCEPT
    -A INPUT -s x.x.x.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
    -A INPUT -s x.x.x.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
    -A INPUT -j DROP
    COMMIT
    # Completed on Wed Mar 2 11:43:28 2011


    Kernel IP routing table
    Destination Gateway Genmask Flags MSS Window irtt Iface
    x.x.x.0 0.0.0.0 255.255.254.0 U 0 0 0 eth0
    0.0.0.0 x.x.x.1 0.0.0.0 UG 0 0 0 eth0


    ifconfig
    eth0 Link encap:Ethernet HWaddr 00:22:19:09:71:e0
    inet addr.x.x.63 Bcast.x.x.255 Mask:255.255.254.0
    UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
    RX packets:154354 errors:0 dropped:0 overruns:0 frame:0
    TX packets:9826 errors:0 dropped:0 overruns:0 carrier:0
    collisions:0 txqueuelen:1000
    RX bytes:15532182 (15.5 MB) TX bytes:857922 (857.9 KB)
    Interrupt:16

    lo Link encap:Local Loopback
    inet addr:127.0.0.1 Mask:255.0.0.0
    UP LOOPBACK RUNNING MTU:16436 Metric:1
    RX packets:0 errors:0 dropped:0 overruns:0 frame:0
    TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
    collisions:0 txqueuelen:0
    RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

  5. #5
    Join Date
    Aug 2010
    Location
    hole
    Beans
    415
    Distro
    Ubuntu

    Re: iptables has blocked all outgoing access

    i have posted a nice script here
    http://ubuntuforums.org/showpost.php...02&postcount=4

    this is a version the will fit you best more:
    PHP Code:

    IPT
    =/sbin/iptables
    $IPT 
    -F
    $IPT 
    -X
    $IPT 
    -t nat -F
    $IPT 
    -P INPUT DROP
    $IPT 
    -P OUTPUT ACCEPT
    $IPT 
    -P FORWARD ACCEPT
    $IPT 
    -t nat -P PREROUTING ACCEPT
    $IPT 
    -t nat -P POSTROUTING ACCEPT


    # Accept all from localhot
    $IPT -A INPUT -i lo -j ACCEPT

    #add this line here to match first the established connections
    $IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

    #also add this specific per if rule to let you use every method to the server just to make sure that everything is done properly.
    #use this specific IP for a specific computer that will allow you to access the server for management purposes.
    $IPT -A INPUT  -s x.x.x.x/32 -j ACCEPT

    #you can add these rules to more secure and safe by limiting "3 hits" per second for an ip
    #defend from simple DOS
    $IPT -A INPUT -p udp -m udp -m limit --limit 3/sec -m state --state NEW
    $IPT -A INPUT -p tcp -m tcp -m limit --limit 3/sec -m state --state NEW

    # Port 80 (www) open, and need add other like ssh or mail 
    $IPT -A INPUT  -s x.x.x.0/24 -p tcp -p tcp -m tcp --dport 22803306 -j ACCEPT

    # ports 22,21 udp for tftp and other stuff of ftp and ssh
    $IPT -A INPUT  -s x.x.x.0/24 -p udp -m udp --dport 21,22 -j ACCEPT 

  6. #6
    Join Date
    Dec 2010
    Beans
    570
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: iptables has blocked all outgoing access

    The one thing that looks to be missing in your rules is:
    Code:
    ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
    or in the iptables-save/iptables-restore syntax:
    Code:
    -A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    This allows the return packets from any connections you initiate.

  7. #7
    Join Date
    Nov 2008
    Location
    Metro Boston
    Beans
    10,239
    Distro
    Kubuntu 14.04 Trusty Tahr

    Re: iptables has blocked all outgoing access

    Along with the ESTABLISHED,RELATED rule, you should be allowing localhost as well.

    Code:
    -A INPUT -i lo -j ACCEPT

  8. #8
    Join Date
    Jun 2007
    Beans
    8

    Re: iptables has blocked all outgoing access

    Ok still not workin right! if I iptables -F I can ping outside no problem
    mikeg@h163-160:~$ sudo iptables -F
    mikeg@h163-160:~$ ping google.com
    PING google.com (209.85.225.106) 56(84) bytes of data.
    64 bytes from iy-in-f106.1e100.net (209.85.225.106): icmp_req=1 ttl=46 time=87.9 ms
    64 bytes from iy-in-f106.1e100.net (209.85.225.106): icmp_req=2 ttl=46 time=87.2 ms
    64 bytes from iy-in-f106.1e100.net (209.85.225.106): icmp_req=3 ttl=46 time=87.2 ms
    64 bytes from iy-in-f106.1e100.net (209.85.225.106): icmp_req=4 ttl=46 time=87.2 ms
    64 bytes from iy-in-f106.1e100.net (209.85.225.106): icmp_req=5 ttl=46 time=87.2 ms

    with iptables loaded I cant even ping localhost!
    ping localhost
    PING localhost (127.0.0.1) 56(84) bytes of data.
    ^C
    --- localhost ping statistics ---
    19 packets transmitted, 0 received, 100% packet loss, time 18015ms

  9. #9
    Join Date
    Jun 2007
    Beans
    8

    Re: iptables has blocked all outgoing access

    ok I figured it out! I needed this

    iptables -A OUTPUT -o lo -j ACCEPT

  10. #10
    Join Date
    Jan 2008
    Beans
    214

    Re: iptables has blocked all outgoing access

    Did you add this as well:

    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

    This basically tells the system to accept any incoming communciations from outside IP addresses that you've requested first. So if you send out a request to open a connection on port 80, then iptables sees the request that comes back as established - and allows it through.

    Brian S.
    http://www.bsntech.com

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •