iptables block everything except http
- by arminb
I'm trying to configure my iptables to block any network traffic except HTTP:
iptables -P INPUT DROP #set policy of INPUT to DROP
iptables -P OUTPUT DROP #set policy of OUTPUT to DROP
iptables -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
The iptables output (iptables -L -v) gives me:
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
4 745 ACCEPT tcp -- any any anywhere anywhere tcp spt:http state RELATED,ESTABLISHED
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
2 330 ACCEPT tcp -- any any anywhere anywhere tcp dpt:http state NEW,ESTABLISHED
When I try to wget 127.0.0.1 (yes i do have a web server and it works fine) i get:
--2012-11-14 16:29:01-- http://127.0.0.1/
Connecting to 127.0.0.1:80...
The request never finishes. What am I doing wrong? I'm setting iptables to DROP everything by default and add a rule to ACCEPT HTTP.
