iptables block everything except http

Posted by arminb on Super User See other posts from Super User or by arminb
Published on 2012-11-14T15:29:51Z Indexed on 2012/11/14 17:07 UTC
Read the original article Hit count: 182

Filed under:
|
|

I'm trying to configure my iptables to block any network traffic except HTTP:

iptables -P INPUT DROP #set policy of INPUT to DROP
iptables -P OUTPUT DROP #set policy of OUTPUT to DROP

iptables -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

The iptables output (iptables -L -v) gives me:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    4   745 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp spt:http state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    2   330 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http state NEW,ESTABLISHED

When I try to wget 127.0.0.1 (yes i do have a web server and it works fine) i get:

--2012-11-14 16:29:01--  http://127.0.0.1/
Connecting to 127.0.0.1:80...

The request never finishes. What am I doing wrong? I'm setting iptables to DROP everything by default and add a rule to ACCEPT HTTP.

© Super User or respective owner

Related posts about linux

Related posts about linux-mint