Home / server / Questions / 193688
In Process
IAPaddler
Asked: 2010-10-22 18:25:41 +0800 CST

Linux Firewall Rules

  • 772

I've configured firewall rules using iptables. Outbound packets are being blocked. It seems like outbound packets are enabled. Does the use of bonding change anything, or do I just have incomplete rules?

/sbin/iptables -A INPUT -i bond0 -j ACCEPT
/sbin/iptables -A OUTPUT -o bond0 -j ACCEPT
/sbin/iptables -A OUTPUT -o bond1 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -p tcp --dport 443 -j ACCEPT
/sbin/iptables -A INPUT -i bond1 -j DROP
/sbin/service iptables save
firewall iptables linux-networking

1 Answers

  1. Bonding does not make a difference.

    If that is the complete rule set, then your problem isn't that you are blocking outbound packets. I suspect if you ran a capture on some device outside, you would see packets leaving your system, and you would even see replies.

    The easiest way to fix this would be to simply use a couple stateful rules like these. They will permit your system to make outbound connections, and the connection tracking will permit the response to be accepted on the INPUT side.

    /sbin/iptables -t filter -A OUTPUT -m state --state NEW\,ESTABLISHED -j ACCEPT
/sbin/iptables -t filter -A INPUT -m state --state ESTABLISHED -j ACCEPT
    • 1