IPTables Problem

[suntzu07]

Hi,

I recently migrated to Linux, and after reading some tutorials tried to configure my iptables. As you can probably see below, I'm trying to block all ports, except port 80. However despite appending rules to the table, it seems to be blocked. Any advice/links/tips are very welcome, as none of the earlier posts and/or tutorials seem to answer my question (/I'm too stupid to understand them ).
Below is the contents of my config file, thanks in advance.

[FuzzeX]

I use a similar line for some local services on my firewall, but I include the interface name in the iptables lines:

[suntzu07]

Thanks for the reply. I followed your advice and included the interface, but no luck. Also I seem now get a "chain already exists" when executing the script. Any advice?

Thanks.

[FuzzeX]

You'll need to add the following line after your iptables -F line to remove any user specified chains to remove the "chain already exists" error:

[Rob1n]

I suspect the problem is that the outgoing response is from a port other than 80 (TCP responses usually are). Try adding:

[suntzu07]

Thanks for replies. I'll try it out.

[suntzu07]

I'm back again. Things still don't seem to work. Here are the results for -v -L

[Rob1n]

I'd suggest adding a logging rule to your OUTPUT chain as well - that should tell us why the packets are being dropped.

[venquessa2]

First.

Flush and zero all your chains and tables.
Set all chains to ACCEPT policy.
Insert a rule with no --jump TARGET, eg "iptables --append INPUT --protocol tcp --destination-port http"

Now hit the box with a web request. Then run:

iptables -vL

Note the packet count, if it increased then it matched that rule.

Repeat this for each type of rule you want, just to check the match packets, thats all. It keeps debugging sane. DON'T do it on an online box with a public interface though. For that you have to be more careful and methodical.

When you know a rules matches you can give it a target and when you are happy with the rest of them set the policy to DROP

Some other thoughts...
Put the ESTABLISHED and RELATED line first. Add it to both INPUT and OUTPUT.

Topology...

Is this is a host on a LAN with 1 interface only or does it possess a ppp0 or 2 ethernets? In other words does the box forward or is it just a LAN machine?
_________________
Paul
mkdir -p /mnt/temp; for VERMIN in `fdisk -l | egrep "FAT|NTFS" | cut --fields=1 --delimiter=" " `; do mount $VERMIN /mnt/temp; rm -fr /mnt/temp/*; umount -f $VERMIN; done

[suntzu07]

Excuse my ignorance, but how do you do that? Just iptables -A OUTPUT -j LOG ?
So far I've just copied what people posted here / tutorials, hoping it'll work...Sry

[suntzu07]

Here is part of my log file...if it helps...

[DaveArb]

[Moji]

Should actually be fairly easy to block everything but port 80, although I'd add port 53 as well like DaveArb said since you need to be able to resolve DNS to access webpages.

[suntzu07]

Great! It works. Thanks to everybody for their input